Skip to content
OpenAdvisories
Medium WID-SEC-2022-0029 8 CVEs

Elasticsearch und Kibana: Mehrere Schwachstellen

Published Sep 1, 2021 · Updated Aug 31, 2026 · Revision 9 · de-DE

Vendor: amazon Vendor: Dell Vendor: F5 Vendor: Oracle Vendor: Red Hat Vendor: SUSE Product: BIG-IP Product: Enterprise Linux Product: Linux Product: Linux Product: Linux 2 Product: Secure Connect Gateway Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Elasticsearch und Kibana ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen und um Administratorrechte zu erlangen.

Product

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.
Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 8

  • Medium 6.6
    CVE-2021-22150

    Kibana code execution issue

    It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana serve…

    Elastic Kibana
  • Medium 5.9
    CVE-2021-37937

    Elasticsearch privilege escalation

    An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compr…

    Elastic Elasticsearch elasticsearch Ubuntu
  • Medium 5.4
    CVE-2021-37936

    It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an…

    Elastic Kibana
  • Low 3.1
    CVE-2021-22151

    Kibana path traversal issue

    It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.

    Elastic Kibana
  • Unscored —
    CVE-2021-22930 EPSS 36%

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to…

    Node.js node nodejs nodejs Debian Azure Linux Alpine
  • Unscored —
    CVE-2021-22931 EPSS 22%

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to mis…

    Node.js node nodejs nodejs Azure Linux Alpine
  • Unscored —
    CVE-2021-22939 EPSS 15%

    If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no …

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2021-3672

    A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name S…

    nodejs nodejs-current ceph c-ares Debian Ubuntu Azure Linux Alpine

Revision history

  1. #9

    Neue Updates von Dell aufgenommen

  2. #8

    Neue Updates von Red Hat aufgenommen

  3. #7

    Neue Updates von Red Hat aufgenommen

  4. #6

    Neue Updates von Red Hat aufgenommen

  5. #5

    Neue Updates von Amazon aufgenommen

  6. #4

    Neue Updates von F5 aufgenommen

  7. #3

    Neue Updates von Oracle Linux und SUSE aufgenommen

  8. #2

    Neue Updates von Red Hat aufgenommen

  9. #1

    Initiale Fassung

References