CVE-2019-7608: Elastic Kibana

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

Affected products

• Elastic Kibana: before 5.6.15 (fixed in 5.6.15); from 6.0.0, before 6.6.1 (fixed in 6.6.1)

Published 2019-03-25. Last modified 2026-06-17.