PT-2022-10685 · Elastic · Kibana

Published 2022-11-18 · Updated 2025-04-29 · CVE-2021-37936

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description It was discovered that Kibana was not sanitizing document fields containing HTML snippets. An attacker with the ability to write documents to an Elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-37936

Affected Products

Kibana

References · 7

• https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37936 · Security Note
• https://elastic.co/community/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37936 · Vendor Advisory
• https://t.me/cibsecurity/53198 · Telegram Post
• https://t.me/cvenotify/38100 · Telegram Post
• https://t.me/cvenotify/120190 · Telegram Post