CVE-2021-37936CWE-79

It was discovered that Kibana was not sanitizing document fields containing HTML snippets

Medium · published November 18, 2022

CVSS v3.1
5.4
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00503 · 42.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-11-18T00:00Z
EPSS history
Timeline
  • 18 NOV 00:00Z
    It was discovered that Kibana was not sanitizing document fields containing HTML snippets
    cvelistv5