PT-2021-14867 · Elastic · Kibana

Dominic Couture · Published 2021-05-13 · Updated 2021-05-21 · CVE-2021-22139

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Kibana versions prior to 7.12.1

Description: A denial of service issue was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host connection pool, making Kibana unavailable for all other users.

Recommendations: For versions prior to 7.12.1, update to version 7.12.1 or later to resolve the issue. As a temporary workaround, consider restricting access to create webhook actions to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-22139

Affected Products

Kibana

References · 4

• https://discuss.elastic.co/t/7-12-1-security-update/271433 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22139 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22139 · Vendor Advisory
• https://t.me/cvenotify/14822 · Telegram Post