CVE-2021-37936
published 2022-11-18CVE-2021-37936: It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write…
PriorityP424medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.46%
36.3th percentile
It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | < 7.14.1 | 7.14.1 |
| elastic | kibana | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p8x3-m7c8-mcj5: It was discovered that Kibana was not sanitizing document fields containing HTML snippets
ghsa_unreviewed·2022-11-19
CVE-2021-37936 [MEDIUM] CWE-79 GHSA-p8x3-m7c8-mcj5: It was discovered that Kibana was not sanitizing document fields containing HTML snippets
It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.
Red Hat
kibana: HTML injection issue (ESA-2021-23)
vendor_redhat·2022-11-19·CVSS 5.4
CVE-2021-37936 [MEDIUM] CWE-79 kibana: HTML injection issue (ESA-2021-23)
kibana: HTML injection issue (ESA-2021-23)
It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.
A flaw was found in Kibana. This issue occurs due to Kibana not sanitizing document fields containing HTML snippets. An attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.
Statement: - Red Hat OpenShift Logging uses Kibana 5.x which is not affected by this CVE.
- The puppet-kibana3 package is ship
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-11-18
Published