Lucene search
PRIOn knowledge basePRION:CVE-2021-37936HistoryNov 18, 2022 - 11:15 p.m.
Hardcoded credentials
2022-11-1823:15:00
PRIOn knowledge base
www.prio-n.com
3
hardcoded credentials
sanitizing
html injection
elasticsearch
discover app
It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.
Related
cvelist
cvelist
CVE-2021-37936
2022-11-18 00:00:00
nvd
nvd
CVE-2021-37936
2022-11-18 23:15:19
openvas
openvas
Elastic Kibana HTML Injection Vulnerability (ESA-2021-23)
2021-09-27 00:00:00
osv
osv
CVE-2021-37936
2022-11-18 23:15:19
veracode
veracode
Cross-site Scripting (XSS)
2022-11-23 10:21:45
cve
cve
CVE-2021-37936
2022-11-18 23:15:19
redhatcve
redhatcve
CVE-2021-37936
2022-11-24 13:26:02
nessus
nessus
Kibana 7.10.2 < 7.14.1 Code Execution
2023-01-11 00:00:00
Kibana 7.14.0 HTML Injection
2023-01-11 00:00:00
Kibana 7.9.0 < 7.14.1 Path Traversal
2023-01-11 00:00:00