Vulnerability · Published Nov 18, 2021 · Assigned by elastic

CVE-2021-37939

Low 2.7

In plain English

A low-severity information exposure in Kibana from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)2.7Low

Exploit odds (30 days)0.5%top 60.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connectors to view limited HTTP response data on hosts accessible to the cluster.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	kibana	7.15.2	GHSA-hp5f-qqrw-c8gj

Affected products (as reported)

Vendor	Product	Versions
Elastic	Kibana	All versions from 7.8.0 through 7.15.1

Weakness: CWE-200

References

https://discuss.elastic.co/t/kibana-7-15-2-security-update/288923 x_refsource_MISC