Elastic Kibana

• CVE-2024-23446 Medium 6.5 Kibana Broken Access Control issue 0.5%
• CVE-2023-46675 High 8.0 Kibana Insertion of Sensitive Information into Log File 0.7%
• CVE-2023-46671 High 8.0 Kibana Insertion of Sensitive Information into Log File 0.7%
• CVE-2021-22142 Medium 6.6 Kibana Reporting vulnerabilities 1.0%
• CVE-2021-22151 Low 3.1 Kibana path traversal issue 0.7%
• CVE-2021-22150 Medium 6.6 Kibana code execution issue 1.2%
• CVE-2023-31422 Critical 9.0 Kibana Insertion of Sensitive Information into Log File 0.8%
• CVE-2023-31415 Critical 9.9 Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This 1.0%
• CVE-2023-31414 High 8.2 Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execut 0.6%
• CVE-2022-38779 Unrated An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. 0.5%
• CVE-2022-38778 Medium 6.5 A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process. 0.9%
• CVE-2021-37936 Medium 5.4 It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inj 0.5%
• CVE-2021-22141 Medium 6.1 An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary websit 0.6%
• CVE-2022-23713 Unrated A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser. 0.9%
• CVE-2022-23711 Unrated A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the healt 0.9%
• CVE-2022-23710 Unrated A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s 0.8%
• CVE-2022-23709 Unrated A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite ex 0.6%
• CVE-2022-23707 Unrated An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index patter 0.5%
• CVE-2021-37939 Unrated It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vu 0.5%
• CVE-2021-37938 Unrated It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily trave 0.7%
• CVE-2021-22139 Unrated Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create 1.0%
• CVE-2021-22136 Unrated In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected. This was caused by background poll 0.3%
• CVE-2020-7016 Unrated Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user can lead to the Kibana process consuming l 1.1%
• CVE-2020-7017 Unrated In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or create a region map visualization could obtain sensitive infor 1.2%
• CVE-2020-7015 Unrated Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization could allow the attacker to obtain sensitive 0.8%
• CVE-2020-7013 Unrated Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to 2.1%
• CVE-2020-7012 Unrated Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data 18.2%