CVE-2021-22150CWE-94

Kibana code execution issue

Medium · published November 22, 2023

CVSS v3.1
6.6
EPSS
1%
Percentile
66.8
In the wild
Unconfirmed
What it is

It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01154 · 66.8th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2023-11-22T00:30Z
EPSS history
Timeline
  • 22 NOV 00:30Z
    Kibana code execution issue
    cvelistv5