Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage known Chromium vulnerabilities to conduct further attacks. Kibana contains a number of protections to prevent this browser from rendering arbitrary content.
References
| Link | Resource |
|---|---|
| https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964/1 | Vendor Advisory |
| https://www.elastic.co/community/security | Vendor Advisory |
| https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964/1 | Vendor Advisory |
| https://www.elastic.co/community/security | Vendor Advisory |
Configurations
History
21 Nov 2024, 05:49
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.6 |
| References | () https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964/1 - Vendor Advisory | |
| References | () https://www.elastic.co/community/security - Vendor Advisory |
01 Dec 2023, 18:43
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Elastic kibana
Elastic |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CPE | cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* | |
| References | () https://www.elastic.co/community/security - Vendor Advisory | |
| References | () https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964/1 - Vendor Advisory | |
| CWE | NVD-CWE-Other |
22 Nov 2023, 03:36
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-22 01:15
Updated : 2024-11-21 05:49
NVD link : CVE-2021-22142
Mitre link : CVE-2021-22142
CVE.ORG link : CVE-2021-22142
JSON object : View
Products Affected
elastic
- kibana
CWE