CVE-2021-37938
It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension. Thanks to Dominic Couture for finding this vulnerability.
Published
2021-11-18T16:15:08.817
Last Modified
2024-11-21T06:16:06.607
Status
Modified
Source
[email protected]
Severity
CVSSv3.1: 4.3 (MEDIUM)
CVSSv2 Vector
AV:N/AC:L/Au:S/C:P/I:N/A:N
- Access Vector: NETWORK
- Access Complexity: LOW
- Authentication: SINGLE
- Confidentiality Impact: PARTIAL
- Integrity Impact: NONE
- Availability Impact: NONE
Exploitability Score
8.0
Impact Score
2.9
Weaknesses
-
Type: Secondary
CWE-269
-
Type: Primary
CWE-22
Affected Vendors & Products
| Type |
Vendor |
Product |
Version/Range |
Vulnerable? |
| Application |
elastic
|
kibana
|
< 7.15.2 |
Yes
|
References