CVE-2020-7015: 
Kibana vulnerability analysis and mitigation

Kibana versions before 6.8.9 and 7.7.0 contain a stored Cross-Site Scripting (XSS) vulnerability in the TSVB visualization component. The vulnerability was assigned CVE-2020-7015 and was disclosed on January 14, 2020. This security flaw affects the Kibana visualization platform, which is a key component of the Elastic Stack and is also integrated into various enterprise products including Red Hat OpenShift Container Platform (CVE Mitre, Red Hat Advisory).

The vulnerability is classified as a stored XSS flaw specifically affecting the TSVB (Time Series Visual Builder) visualization component in Kibana. The issue allows attackers with the ability to edit or create TSVB visualizations to potentially execute malicious scripts (CVE Mitre).

The exploitation of this vulnerability could allow attackers to obtain sensitive information from, or perform destructive actions on behalf of, Kibana users who edit the TSVB visualization. This impact is particularly significant in environments where multiple users have access to the Kibana interface (Debian Tracker).

The vulnerability requires an attacker to have sufficient privileges to edit or create TSVB visualizations within the Kibana interface. This prerequisite somewhat limits the scope of potential attackers, as they must first gain access to the Kibana interface with appropriate permissions (CVE Mitre).

The vulnerability has been addressed in Kibana versions 6.8.9 and 7.7.0. Users are advised to upgrade to these or later versions to mitigate the risk. The fix was also included in Red Hat OpenShift Container Platform 4.5.8 security update (Red Hat Advisory).