Need info regarding Kibana XSS issue (ESA-2019-01)

[fragatina]

Hi,

I'm evaluating Kibana XSS issue (ESA-2019-01) mentioned here:

Elastic Stack 6.6.1 and 5.6.15 security update

Kibana XSS issue (ESA-2019-01) Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Affected Versions Kibana versions before 5.6.15 and 6.6.1 Solutions and Mitigations: Users should upgrade to Kibana version 6.6.1 or 5.6.15 CVE ID: CVE-2019-7608 Kibana Timelion Remote Code Execution issue (ESA-2019-02) Kibana versions before …

this seems different from previous Kibana XSS scripting issue (ESA-2018-14), right?
I'd appreciate if somebody could provide the github PR for this fix.

Thanks!

[nickpeihl]

The PR that fixed this is here: https://github.com/elastic/kibana/pull/28834

[fragatina]

the user Shannon75 (https://discuss.elastic.co/u/shannon75) sent me an email via elastic@discoursemail about this topic with the following body of the email:
Kibana had a cross-site scripting vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users vidmate.

However, I don't see this content being posted here. Hence, I don't now if the email is spam or a real response. If it's the former, then be aware of it. If it's the latter, then, please, can you provide the link to the right PR (because the one provided seems to be for timelion only)