Unscored severity · published Jun 15, 2015
CVE-2015-4093
Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
–
CVSS
2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
Kibana · Elastic
4.0.0; 4.0.1; 4.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4093
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4093
packetstormsecurity.com
http://packetstormsecurity.com/files/132232/Kibana-4.0.2-Cross-Site-Scripting.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/535726/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/75107
Vendor Advisory
https://www.elastic.co/community/security/
More from Kibana
10.0
CVE-2019-7609
Kibana Arbitrary Code Execution
9.9
CVE-2025-25015
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests
9.8
CVE-2025-25014
Kibana arbitrary code execution via prototype pollution
9.8
CVE-2024-12556
Kibana Prototype Pollution can lead to code injection
9.8
CVE-2018-17246
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin