CVE-2022-38778

2023-02-0821:15:10

CWE-20

[email protected]

web.nvd.nist.gov

kibana

third party

authenticated user

server process

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.7

Confidence

High

EPSS

0.004

Percentile

73.4%

JSON

A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.

Affected configurations

Nvd

Node

decode-uri-component_projectdecode-uri-componentRange<0.2.1node.js

elastickibanaRange7.0.0–7.17.9

elastickibanaRange8.0.0–8.6.1

VendorProductVersionCPE
decode-uri-component_projectdecode-uri-component*cpe:2.3:a:decode-uri-component_project:decode-uri-component:*:*:*:*:*:node.js:*:*
elastickibana*cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
decode-uri-component_project	decode-uri-component	*	cpe:2.3:a:decode-uri-component_project:decode-uri-component::::::node.js::*
elastic	kibana	*	cpe:2.3:a:elastic:kibana::::::::