CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22151 – Kibana path traversal issue
https://notcve.org/view.php?id=CVE-2021-22151
It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension. Se descubrió que Kibana no estaba validando una ruta proporcionada por el usuario, que cargaría archivos .pbf. Debido a esto, un usuario malintencionado podría atravesar arbitrariamente el host de Kibana para cargar archivos internos que terminen en la extensión .pbf. • https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077 https://www.elastic.co/community/security • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22150 – Kibana code execution issue
https://notcve.org/view.php?id=CVE-2021-22150
It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server. Se descubrió que un usuario con permisos de administrador Fleet podía cargar un paquete malicioso. Debido al uso de una versión anterior de la librería js-yaml, este paquete se cargaría de forma insegura, lo que permitiría a un atacante ejecutar comandos en el servidor Kibana. • https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077 https://www.elastic.co/community/security • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-38779
https://notcve.org/view.php?id=CVE-2022-38779
An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. • https://discuss.elastic.co/t/kibana-7-17-9-and-8-6-2-security-update/325782 https://www.elastic.co/community/security • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-38778
https://notcve.org/view.php?id=CVE-2022-38778
A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process. • https://discuss.elastic.co/t/elastic-7-17-9-8-5-0-and-8-6-1-security-update/324661 https://www.elastic.co/community/security • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-22141
https://notcve.org/view.php?id=CVE-2021-22141
An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website. Se encontró una falla de redireccionamiento abierto en las versiones de Kibana anteriores a la versiones 7.13.0 y 6.8.16. Si un usuario que ha iniciado sesión visita una URL creada con fines malintencionados, Kibana podría redirigir al usuario a un sitio web arbitrario. • https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964 https://www.elastic.co/community/security • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •