We have hosted a dockerized elastic stack in AWS ec2 instance and ran nessus scan on that instance. In the report of nessus scan, Web Server Generic XSS vulnerability is detected in elasticsearch. Currently we are using 6.6.1 version. [08%20PM]

Hi there, Please do not open public topics on potential security issues, we have a documented process for reporting these through : https://www.elastic.co/community/security Regarding this specific one though, it's a false positive. Elasticsearch uses the HTTP protocol to service json requests via…

Discuss the Elastic Stack

Web Server Generic XSS

Elastic Stack Elasticsearch

Topic		Replies	Views
The remote web server is affected by a cross-site scripting vulnerability Elasticsearch docker	2	260	January 19, 2024
Protection against cross scripting attacks (xss) in Elastic Search server? Elasticsearch	6	3192	July 6, 2017
Vulnerabilities on Elastic Search 6.7.1 Elasticsearch	1	427	October 17, 2019
High risk on elasticsearch 9200/tcp Reported by Nessus Elasticsearch	9	1016	November 27, 2017
HTTP Security Header Not Detected - Vulnerability Elasticsearch	6	1039	August 6, 2019

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Web Server Generic XSS

Related topics