CVE-2022-23713

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Elastic	kibana	Versions 7.0.0 through 7.17.4 and 8.0.0 through 8.2.3

References

https://discuss.elastic.co/t/elastic-8-3-1-8-3-0-and-7-17-5-security-update/308613Mitigation, Vendor Advisory
https://www.elastic.co/community/securityVendor Advisory
https://discuss.elastic.co/t/elastic-8-3-1-8-3-0-and-7-17-5-security-update/308613Mitigation, Vendor Advisory
https://www.elastic.co/community/securityVendor Advisory

Timeline

Published: Jul 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-237147.8A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which CVE-2022-237156.5A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearc CVE-2022-237165.3A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in d CVE-2022-237175.5PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security CVE-2022-237188.1PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving CVE-2022-237196.4PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An at CVE-2022-23724.8The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2022-237208.2PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties fi CVE-2022-237213.3PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two peopl CVE-2022-237226.5When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID o CVE-2022-237237.7An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authen CVE-2022-237248.1Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypasse