# Need info regarding Kibana XSS issue (ESA-2019-01)

**URL:** <https://discuss.elastic.co/t/need-info-regarding-kibana-xss-issue-esa-2019-01/174620>\
**Category:** Kibana\
**Created:** [March 30, 2019, 12:58am UTC](https://discuss.elastic.co/t/need-info-regarding-kibana-xss-issue-esa-2019-01/174620 "2019-03-30T00:58:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fragatina](https://avatars.discourse-cdn.com/v4/letter/f/ccd318/32.png) [@fragatina](https://discuss.elastic.co/u/fragatina)\
**Post date:** [March 30, 2019, 12:58am UTC](https://discuss.elastic.co/t/need-info-regarding-kibana-xss-issue-esa-2019-01/174620/1 "2019-03-30T00:58:17Z")

</div>

Hi,

I'm evaluating Kibana XSS issue (ESA-2019-01) mentioned here:

> [@Elastic Stack 6.6.1 and 5.6.15 security update](https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077):
>
> Kibana XSS issue (ESA-2019-01) Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Affected Versions Kibana versions before 5.6.15 and 6.6.1 Solutions and Mitigations: Users should upgrade to Kibana version 6.6.1 or 5.6.15 CVE ID: CVE-2019-7608 Kibana Timelion Remote Code Execution issue (ESA-2019-02) Kibana versions before …

this seems different from previous Kibana XSS scripting issue (ESA-2018-14), right?  
I'd appreciate if somebody could provide the github PR for this fix.

Thanks!

---

<div class="post-metadata">

**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\
**Post date:** [April 1, 2019, 3:17pm UTC](https://discuss.elastic.co/t/need-info-regarding-kibana-xss-issue-esa-2019-01/174620/2 "2019-04-01T15:17:17Z")

</div>

The PR that fixed this is here: [https://github.com/elastic/kibana/pull/28834](https://github.com/elastic/kibana/pull/28834)

---

<div class="post-metadata">

**Author:** ![fragatina](https://avatars.discourse-cdn.com/v4/letter/f/ccd318/32.png) [@fragatina](https://discuss.elastic.co/u/fragatina)\
**Post date:** [April 10, 2019, 6:36pm UTC](https://discuss.elastic.co/t/need-info-regarding-kibana-xss-issue-esa-2019-01/174620/4 "2019-04-10T18:36:00Z")

</div>

the user Shannon75 ([https://discuss.elastic.co/u/shannon75](https://discuss.elastic.co/u/shannon75)) sent me an email via elastic@discoursemail about this topic with the following body of the email:  
Kibana had a cross-site scripting vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users [vidmate](https://vidmate.ooo/).

However, I don't see this content being posted here. Hence, I don't now if the email is spam or a real response. If it's the former, then be aware of it. If it's the latter, then, please, can you provide the link to the right PR (because the one provided seems to be for timelion only)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2019, 6:36pm UTC](https://discuss.elastic.co/t/need-info-regarding-kibana-xss-issue-esa-2019-01/174620/5 "2019-05-08T18:36:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.