Kibana 8.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-66 / ESA-2026-69 / ESA-2026-71 / ESA-2026-72)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(330365);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/29");

  script_cve_id(
    "CVE-2026-63142",
    "CVE-2026-63145",
    "CVE-2026-63260",
    "CVE-2026-63261"
  );
  script_xref(name:"IAVB", value:"2026-B-0199");

  script_name(english:"Kibana 8.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-66 / ESA-2026-69 / ESA-2026-71 / ESA-2026-72)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana installed on the remote host is 8.x prior to 8.19.19, or 9.0.x prior to 9.3.8, or 9.4.x prior
to 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-66, ESA-2026-69,
ESA-2026-71, and ESA-2026-72 advisories.

  - Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive
    Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of
    service condition in Kibana by sending a specially crafted, oversized request payload. Processing this
    user-supplied input requires resource-intensive memory allocation that can exhaust the available heap
    memory in the Kibana process, causing it to crash and become unavailable to all users. (CVE-2026-63260)

  - Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive
    Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a
    Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to
    all users. (CVE-2026-63261)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-66/388568
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9956b844");
  # https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-69/388572
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e6b9706a");
  # https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-71/388574
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?84469fd3");
  # https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-72/388575
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?463ecf7e");
  script_set_attribute(attribute:"solution", value:
"Update to Kibana version 8.19.19, 9.3.8, 9.4.4 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-63260");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-63142");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/28");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana");
  script_require_ports("Services/www", 5601);

  exit(0);
}

include('http.inc');
include('vcf.inc');

var app = 'Kibana';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:5601);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '8.0.0', 'fixed_version' : '8.19.19' },
  { 'min_version' : '9.0.0', 'fixed_version' : '9.3.8' },
  { 'min_version' : '9.4.0', 'fixed_version' : '9.4.4' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_WARNING
);