CVE-2021-37936

Published Nov 18, 2022

Last updated 2 years ago

CVSS medium 5.4

Overview

Description: It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.
Source: bressers@elastic.co
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.4
Impact score: 2.7
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-79
bressers@elastic.co: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8B73691E-6E6F-45F2-8C0C-E32CFBAD3CBB",
            "versionEndExcluding": "7.14.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References