Kibana
by Elastic
Source repositories
CVEs (115)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-37279 | 0.00 | — | 0.00 | Jun 13, 2024 | A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries. | |||
| CVE-2024-23446 | 0.00 | — | 0.01 | Feb 7, 2024 | An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain… | |||
| CVE-2023-46675 | 0.00 | — | 0.01 | Dec 13, 2023 | An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log… | |||
| CVE-2023-46671 | 0.00 | — | 0.01 | Dec 13, 2023 | An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account credentials for the kibana_system… | |||
| CVE-2021-22142 | 0.00 | — | 0.01 | Nov 22, 2023 | Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage known Chromium… | |||
| CVE-2021-22151 | 0.00 | — | 0.01 | Nov 22, 2023 | It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension. | |||
| CVE-2021-22150 | 0.00 | — | 0.01 | Nov 22, 2023 | It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server. | |||
| CVE-2023-31422 | 0.00 | — | 0.01 | Oct 26, 2023 | An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern. Elastic has… | |||
| CVE-2023-31415 | 0.00 | — | 0.01 | May 4, 2023 | Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system… | |||
| CVE-2023-31414 | 0.00 | — | 0.01 | May 4, 2023 | Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands… | |||
| CVE-2022-38779 | 0.00 | — | 0.01 | Feb 21, 2023 | An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. | |||
| CVE-2022-38778 | 0.00 | — | 0.01 | Feb 8, 2023 | A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process. | |||
| CVE-2021-37936 | 0.00 | — | 0.00 | Nov 18, 2022 | It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML,… | |||
| CVE-2021-22141 | 0.00 | — | 0.01 | Nov 18, 2022 | An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website. | |||
| CVE-2022-23713 | 0.00 | — | 0.01 | Jul 6, 2022 | A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser. | |||
| CVE-2022-23711 | 0.00 | — | 0.01 | Apr 21, 2022 | A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the health and performance of your Elasticsearch cluster. Authentication with a… | |||
| CVE-2022-23710 | 0.00 | — | 0.01 | Mar 3, 2022 | A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s browser. | |||
| CVE-2022-23709 | 0.00 | — | 0.01 | Mar 3, 2022 | A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modified rules would not be enabled, and a… | |||
| CVE-2022-23707 | 0.00 | — | 0.01 | Feb 11, 2022 | An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index pattern which could execute against other users | |||
| CVE-2021-37939 | 0.00 | — | 0.00 | Nov 18, 2021 | It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could… |
- CVE-2024-37279Jun 13, 2024risk 0.00cvss —epss 0.00
A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.
- CVE-2024-23446Feb 7, 2024risk 0.00cvss —epss 0.01
An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain…
- CVE-2023-46675Dec 13, 2023risk 0.00cvss —epss 0.01
An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log…
- CVE-2023-46671Dec 13, 2023risk 0.00cvss —epss 0.01
An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account credentials for the kibana_system…
- CVE-2021-22142Nov 22, 2023risk 0.00cvss —epss 0.01
Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage known Chromium…
- CVE-2021-22151Nov 22, 2023risk 0.00cvss —epss 0.01
It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.
- CVE-2021-22150Nov 22, 2023risk 0.00cvss —epss 0.01
It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.
- CVE-2023-31422Oct 26, 2023risk 0.00cvss —epss 0.01
An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern. Elastic has…
- CVE-2023-31415May 4, 2023risk 0.00cvss —epss 0.01
Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system…
- CVE-2023-31414May 4, 2023risk 0.00cvss —epss 0.01
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands…
- CVE-2022-38779Feb 21, 2023risk 0.00cvss —epss 0.01
An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.
- CVE-2022-38778Feb 8, 2023risk 0.00cvss —epss 0.01
A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.
- CVE-2021-37936Nov 18, 2022risk 0.00cvss —epss 0.00
It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML,…
- CVE-2021-22141Nov 18, 2022risk 0.00cvss —epss 0.01
An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.
- CVE-2022-23713Jul 6, 2022risk 0.00cvss —epss 0.01
A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser.
- CVE-2022-23711Apr 21, 2022risk 0.00cvss —epss 0.01
A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the health and performance of your Elasticsearch cluster. Authentication with a…
- CVE-2022-23710Mar 3, 2022risk 0.00cvss —epss 0.01
A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s browser.
- CVE-2022-23709Mar 3, 2022risk 0.00cvss —epss 0.01
A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modified rules would not be enabled, and a…
- CVE-2022-23707Feb 11, 2022risk 0.00cvss —epss 0.01
An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index pattern which could execute against other users
- CVE-2021-37939Nov 18, 2021risk 0.00cvss —epss 0.00
It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could…
Page 5 of 6