CVE-2016-1000220
개요
A cross-site scripting (XSS) flaw was found in Kibana. A remote attacker could use this flaw to inject arbitrary web script into pages served to other users.
CVSS (Common Vulnerability Scoring System) 점수 세부 사항
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 점수 분석
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| 기본 점수 | 5.4 | 6.1 | N/A |
| 공격 벡터 | Network | Network | N/A |
| 공격 복잡성 | Low | Low | N/A |
| 필요한 권한 | None | None | N/A |
| 사용자 상호 작용 | Required | Required | N/A |
| 범위 | Unchanged | Changed | N/A |
| 기밀성 | Low | Low | N/A |
| 무결성에 미치는 영향 | Low | Low | N/A |
| 가용성에 미치는 영향 | None | None | N/A |
벡터
Red Hat: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2 점수 분석
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| 기본 점수 | 4.3 | 4.3 | N/A |
| 공격 벡터 | Network | Network | N/A |
| 액세스 복잡성 | Medium | Medium | N/A |
| 인증 | None | None | N/A |
| 기밀성에 미치는 영향 | None | None | N/A |
| 무결성에 미치는 영향 | Partial | Partial | N/A |
| 가용성에 미치는 영향 | None | None | N/A |
벡터
Red Hat: AV:N/AC:M/Au:N/C:N/I:P/A:N
NVD: AV:N/AC:M/Au:N/C:N/I:P/A:N
취약점 이해 (CWE)
Access Control,Confidentiality
Technical Impact: Bypass Protection Mechanism; Read Application Data
The most common attack performed with cross-site scripting involves the disclosure of private information stored in user cookies, such as session information. Typically, a malicious user will craft a client-side script, which -- when parsed by a web browser -- performs some activity on behalf of the victim to an attacker-controlled system (such as sending all site cookies to a given E-mail address). This could be especially dangerous to the site if the victim has administrator privileges to manage that site. This script will be loaded and run by each user visiting the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
In some circumstances it may be possible to run arbitrary code on a victim's computer when cross-site scripting is combined with other flaws, for example, "drive-by hacking."
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Read Application Data
The consequence of an XSS attack is the same regardless of whether it is stored or reflected. The difference is in how the payload arrives at the server. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Some cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running "Active X" controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content.
