Elastic Kibana

A deserialization issue in Kibana

CVE-2024-37288 8.8 - High - September 09, 2024

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Securitys built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html  and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html .

Marshaling, Unmarshaling

A flaw allowing arbitrary code execution was discovered in Kibana

CVE-2024-37287 7.2 - High - August 13, 2024

A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.

Prototype Pollution

A high-privileged user

CVE-2024-23443 4.9 - Medium - June 19, 2024

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.

An open redirect issue was discovered in Kibana

CVE-2024-23442 6.1 - Medium - June 14, 2024

An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.

Open Redirect

A flaw was discovered in Kibana

CVE-2024-37279 4.3 - Medium - June 13, 2024

A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.

An issue was discovered by Elastic

CVE-2024-23446 6.5 - Medium - February 07, 2024

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.

An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error

CVE-2023-46671 6.5 - Medium - December 13, 2023

An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users. The issue occurs infrequently, only if an error is returned from an Elasticsearch cluster, in cases where there is user interaction and an unhealthy cluster (for example, when returning circuit breaker or no shard exceptions).

Insertion of Sensitive Information into Log File

An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana

CVE-2023-46675 6.5 - Medium - December 13, 2023

An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users, Elastic Security package policy objects which can contain private keys, bearer token, and sessions of 3rd-party integrations and finally Authorization headers, client secrets, local file paths, and stack traces. The issue may occur in any Kibana instance running an affected version that could potentially receive an unexpected error when communicating to Elasticsearch causing it to include sensitive data into Kibana error logs. It could also occur under specific circumstances when debug level logging is enabled in Kibana. Note: It was found that the fix for ESA-2023-25 in Kibana 8.11.1 for a similar issue was incomplete.

Insertion of Sensitive Information into Log File

Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports

CVE-2021-22142 8.8 - High - November 22, 2023

Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage known Chromium vulnerabilities to conduct further attacks. Kibana contains a number of protections to prevent this browser from rendering arbitrary content.

It was discovered that a user with Fleet admin permissions could upload a malicious package

CVE-2021-22150 7.2 - High - November 22, 2023

It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.

Code Injection

It was discovered that Kibana was not validating a user supplied path, which would load .pbf files

CVE-2021-22151 4.3 - Medium - November 22, 2023

It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.

Directory traversal

An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error

CVE-2023-31422 7.5 - High - October 26, 2023

An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern. Elastic has released Kibana 8.10.1 which resolves this issue. The error object recorded in the log contains request information, which can include sensitive data, such as authentication credentials, cookies, authorization headers, query params, request paths, and other metadata. Some examples of sensitive data which can be included in the logs are account credentials for kibana_system, kibana-metricbeat, or Kibana end-users.

Insertion of Sensitive Information into Log File

Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw

CVE-2023-31414 8.8 - High - May 04, 2023

Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.

Code Injection

Kibana version 8.7.0 contains an arbitrary code execution flaw

CVE-2023-31415 8.8 - High - May 04, 2023

Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.

Code Injection

An open redirect issue was discovered in Kibana

CVE-2022-38779 6.1 - Medium - February 22, 2023

An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.

Open Redirect

A flaw (CVE-2022-38900) was discovered in one of Kibanas third party dependencies

CVE-2022-38778 6.5 - Medium - February 08, 2023

A flaw (CVE-2022-38900) was discovered in one of Kibanas third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.

Improper Input Validation

An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16

CVE-2021-22141 6.1 - Medium - November 18, 2022

An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.

Open Redirect

It was discovered that Kibana was not sanitizing document fields containing HTML snippets

CVE-2021-37936 5.4 - Medium - November 18, 2022

It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.

XSS

A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could

CVE-2022-23713 6.1 - Medium - July 06, 2022

A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victims browser.

XSS

A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source

CVE-2022-23711 5.3 - Medium - April 21, 2022

A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the health and performance of your Elasticsearch cluster. Authentication with a vulnerable Kibana instance is not required to view the exposed information. The Elastic Stack monitoring exposure only impacts users that have set any of the optional monitoring.ui.elasticsearch.* settings in order to configure Kibana as a remote UI for Elastic Stack Monitoring. The same vulnerability in Kibana could expose other non-sensitive application-internal information in the page source.

A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules

CVE-2022-23709 4.3 - Medium - March 03, 2022

A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modified rules would not be enabled, and a user with this privilege could not modify alerting connectors. This effectively means that Read users could disable existing alerting rules.

AuthZ

A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could

CVE-2022-23710 6.1 - Medium - March 03, 2022

A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victims browser.

XSS

An XSS vulnerability was found in Kibana index patterns

CVE-2022-23707 5.4 - Medium - February 11, 2022

An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index pattern which could execute against other users

XSS

It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path

CVE-2021-37938 4.3 - Medium - November 18, 2021

It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension. Thanks to Dominic Couture for finding this vulnerability.

Directory traversal

It was discovered that Kibanas JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden

CVE-2021-37939 2.7 - Low - November 18, 2021

It was discovered that Kibanas JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connectors to view limited HTTP response data on hosts accessible to the cluster.

Cleartext Transmission of Sensitive Information

It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe

CVE-2020-10743 4.3 - Medium - June 02, 2021

It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests. This flaw allows an attacker to trick a user into performing arbitrary actions in OCP's distribution of Kibana, such as clickjacking.

Improperly Implemented Security Check for Standard

In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected

CVE-2021-22136 3.5 - Low - May 13, 2021

In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected. This was caused by background polling activities unintentionally extending authenticated users sessions, preventing a user session from timing out.

Insufficient Session Expiration

Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size

CVE-2021-22139 6.5 - Medium - May 13, 2021

Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host connection pool, making Kibana unavailable for all other users.

Resource Exhaustion

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to

CVE-2020-27816 6.1 - Medium - December 02, 2020

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7.

Open Redirect

Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer

CVE-2019-7616 4.9 - Medium - July 30, 2019

Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana access could set the timelion:graphite.url configuration option to an arbitrary URL. This could possibly lead to an attacker accessing external URL resources as the Kibana process on the host system.

SSRF

Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger

CVE-2019-7610 9 - Critical - March 25, 2019

Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

Command Injection

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer

CVE-2019-7609 10 - Critical - March 25, 2019

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

Code Injection

Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability

CVE-2019-7608 6.1 - Medium - March 25, 2019

Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

XSS

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin

CVE-2018-17246 9.8 - Critical - December 20, 2018

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

Inclusion of Functionality from Untrusted Control Sphere

Kibana versions 4.0 to 4.6

CVE-2018-17245 9.8 - Critical - December 20, 2018

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.

Insufficiently Protected Credentials

Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter

CVE-2018-3830 6.1 - Medium - September 19, 2018

Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

XSS

Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter

CVE-2018-3818 6.1 - Medium - March 30, 2018

Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

XSS

The fix in Kibana for ESA-2017-23 was incomplete

CVE-2018-3819 6.1 - Medium - March 30, 2018

The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.

Open Redirect

Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations

CVE-2018-3820 6.1 - Medium - March 30, 2018

Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

XSS

Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization

CVE-2018-3821 6.1 - Medium - March 30, 2018

Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

XSS

The Kibana fix for CVE-2017-8451 was found to be incomplete

CVE-2017-11482 6.1 - Medium - December 08, 2017

The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.

Open Redirect

Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields

CVE-2017-11481 6.1 - Medium - December 08, 2017

Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

XSS

Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion

CVE-2017-11479 6.1 - Medium - September 29, 2017

Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

XSS

Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack

CVE-2016-1000220 6.1 - Medium - June 16, 2017

Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.

XSS

Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack.

CVE-2015-9056 6.1 - Medium - June 16, 2017

Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack.

XSS

With X-Pack installed

CVE-2016-10364 6.5 - Medium - June 16, 2017

With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions.

Permissions, Privileges, and Access Controls

Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.

CVE-2016-10366 6.1 - Medium - June 16, 2017

Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.

XSS

Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in

CVE-2016-1000219 7.5 - High - June 16, 2017

Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.

AuthZ

Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page

CVE-2017-8440 6.1 - Medium - June 05, 2017

Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

XSS

Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder

CVE-2017-8439 6.1 - Medium - June 05, 2017

Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.

XSS