Kibana path traversal issue
CVE-2021-22151

3.1LOW

Key Information:

Vendor

Elastic
Status
Kibana
Vendor
CVE Published:
22 November 2023

What is CVE-2021-22151?

It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.

Affected Version(s)

Kibana 7.9.0 < 7.14.0

References

https://discuss.elastic.co/t/elastic-stack-7-14-1-securit...
https://www.elastic.co/community/security

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2021-22151 : Kibana path traversal issue