HTML Injection Vulnerability in Kibana from Elastic

CVE-2021-37936

Summary

An HTML injection vulnerability exists in Kibana due to improper sanitization of document fields containing HTML snippets. An attacker with write access to an Elasticsearch index could exploit this flaw by injecting HTML into the documents. This could lead to the malicious HTML being rendered when users utilize the Discover app to highlight search terms, potentially compromising user interactions and exposing them to security risks.

References