Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Daten zu manipulieren und um einen Denial-of-Service-Zustand auszulösen.
Product
Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.
Vulnerabilities 2
-
Medium 6.5
Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration
Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly C…
-
Medium 6.5
Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service
Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allows an authenticated user to send a specially crafted Timelion e…
Revision history
-
#1
Initiale Fassung
References
-
Kibana 8.19.12, 9.2.6, 9.3.1 Security Update - ESA-2026-19 vom 2026-03-19
https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-19/385530
-
Kibana 8.19.13, 9.2.7, 9.3.2 Security Update - ESA-2026-20 vom 2026-03-19
https://discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-20/385535