CVE-2021-22150

published 2023-11-22

CVE-2021-22150: It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package…

Priority P3 41 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
elastic	kibana	>= 7.10.2 < 7.14.0	7.14.0
elastic	kibana	>= 7.10.2 < 7.14.1	7.14.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94