Kibana Reporting vulnerabilities
CVE-2021-22142

6.6MEDIUM

Key Information:

Vendor
Elastic
Status
Kibana
Vendor
CVE Published:
22 November 2023

Summary

Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage known Chromium vulnerabilities to conduct further attacks. Kibana contains a number of protections to prevent this browser from rendering arbitrary content.

Affected Version(s)

Kibana 7.0.0 < 7.13.0

References

https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8...
https://www.elastic.co/community/security

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.