CVE-2018-3830
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source...
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
- Record
CVE-2018-3830- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
- Record
CVE-2018-3830- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2018-15617 No score
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
- Record
EUVD-2018-15617- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p82g-h4qx-f53f
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source...
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
- Record
GHSA-p82g-h4qx-f53f- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
- Record
CVE-2018-3830- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2018:3537
Red Hat Security Advisory: OpenShift Container Platform 3.11 security update
- Record
RHSA-2018:3537- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kibanaRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:5.6.12-1.el7 | 0:5.6.12-1.el7 |
jenkins-2-pluginsRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.1539805268-1.el7 | 0:3.11.1539805268-1.el7 |
atomic-openshiftRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.43-1.git.0.647ac05.el7 | 0:3.11.43-1.git.0.647ac05.el7 |
atomic-openshift-clients-redistributableRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.43-1.git.0.647ac05.el7 | 0:3.11.43-1.git.0.647ac05.el7 |
atomic-openshift-docker-excluderRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.43-1.git.0.647ac05.el7 | 0:3.11.43-1.git.0.647ac05.el7 |
atomic-openshift-excluderRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.43-1.git.0.647ac05.el7 | 0:3.11.43-1.git.0.647ac05.el7 |
atomic-openshift-hyperkubeRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.43-1.git.0.647ac05.el7 | 0:3.11.43-1.git.0.647ac05.el7 |
atomic-openshift-hypershiftRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.43-1.git.0.647ac05.el7 | 0:3.11.43-1.git.0.647ac05.el7 |
atomic-openshift-masterRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.43-1.git.0.647ac05.el7 | 0:3.11.43-1.git.0.647ac05.el7 |
atomic-openshift-nodeRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.43-1.git.0.647ac05.el7 | 0:3.11.43-1.git.0.647ac05.el7 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
atomic-openshift-podRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.43-1.git.0.647ac05.el7 | 0:3.11.43-1.git.0.647ac05.el7 |
atomic-openshift-sdn-ovsRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.43-1.git.0.647ac05.el7 | 0:3.11.43-1.git.0.647ac05.el7 |
atomic-openshift-template-service-brokerRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.43-1.git.0.647ac05.el7 | 0:3.11.43-1.git.0.647ac05.el7 |
atomic-openshift-testsRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.43-1.git.0.647ac05.el7 | 0:3.11.43-1.git.0.647ac05.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-3830 is a medium vulnerability (CVSS 6.1) in Elastic Kibana, published September 19, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.63%, the 76th percentile. No source names a fixed version.
References
discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035
access.redhat.com/errata/RHSA-2018:3537
elastic.co/community/security
nvd.nist.gov/vuln/detail/CVE-2018-3830
github.com/advisories/GHSA-p82g-h4qx-f53f
Show 49 moreShow less
docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html
bugzilla.redhat.com/show_bug.cgi?id=1552304
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3537.json
cve.org/CVERecord?id=CVE-2018-3830
groups.google.com/forum