Lucene search

HistoryJan 11, 2023 - 12:00 a.m.

Kibana 7.10.2 < 7.14.1 Code Execution

2023-01-1100:00:00

www.tenable.com

kibana

version 7.10.2

7.14.1

code execution

js-yaml

cve-2021-22150

html injection

document fields

cve-2021-22151

path traversal

.pbf files

cve-2021-37936

scanner

security document

0.001 Low

EPSS

Percentile

22.9%

According to its self-reported version number, the Kibana application running on the remote host is prior to 7.14.1. It is, therefore, affected by :

A code execution vulnerability due to an older version of js-yaml (CVE-2021-22150)
An HTML Injection due to a lack of sanitization of document fields containing html snippets (CVE-2021-22151)
A Path Traversal through .pbf files (CVE-2021-37936)

Note that the scanner has not tested for these issues but has instead relied only on the application’s self-reported version number.

No source data

VendorProductVersionCPE
elasticsearchkibana*cpe:2.3:a:elasticsearch:kibana:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
elasticsearch	kibana	*	cpe:2.3:a:elasticsearch:kibana::::::::

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22150

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22151

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37936

discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077

www.elastic.co/community/security

0.001 Low

EPSS

Percentile

22.9%

Related for WEB_APPLICATION_SCANNING_113521