QID 375877

Date Published: 2021-09-28

QID 375877: Kibana Multiple Security Vulnerabilities (ESA-2021-21, ESA-2021-22, ESA-2021-24)

Kibana is an open source data visualization plugin for Elasticsearch. It provides visualization capabilities on top of the content indexed on an Elasticsearch cluster. Users can create bar, line and scatter plots, or pie charts and maps on top of large volumes of data.

CVE-2021-22150: It was discovered that a user with fleet admin permissions could upload a malicious package.
CVE-2021-22151: It was discovered that Kibana was not validating a user supplied path, which would load .pbf files.
CVE-2021-22930, CVE-2021-3672, CVE-2021-22931, CVE-2021-22930, CVE-2021-22939: Kibana 7.14.1 upgrades Node.js to version 14.17.5 to resolve multiple issues there in Node.js version 14.17.3.

Affected Version:
All versions of Kibana before 7.14.1 are affected by this flaw

QID Detection Logic:(Authenticated)
This authenticated QID checks for Kibana version by running "/usr/share/kibana/bin/kibana --version" command.

QID Detection Logic:(Unauthenticated)
This QID sends a GET request to find if the target is running a vulnerable version of kibana.

Successful exploitation of these vulnerabilities may affect confidentiality, integrity and availability of the targeted user.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as High - 7.5 severity.

Solution

Vendor has released fix to this vulnerability.

Customers are advised to refer to ESA-2021-21, ESA-2021-22 and ESA-2021-24 for more information.

Vendor References

ESA-2021-21 - www.elastic.co/community/security
ESA-2021-22 - www.elastic.co/community/security
ESA-2021-24 - www.elastic.co/community/security

CVEs related to QID 375877

CVE-2021-22150 | CVE-2021-22151 | CVE-2021-22930 | CVE-2021-3672 | CVE-2021-22931 | CVE-2021-22930 | CVE-2021-22939 |

Software Advisories

Advisory ID	Software	Component	Link
ESA-2021-21			www.elastic.co/community/security
ESA-2021-22			www.elastic.co/community/security
ESA-2021-24			www.elastic.co/community/security

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].