It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.
References
Link | Resource |
---|---|
https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077 | Vendor Advisory |
https://www.elastic.co/community/security | Vendor Advisory |
Configurations
History
01 Dec 2023, 18:53
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* | |
CWE | CWE-94 | |
References | () https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077 - Vendor Advisory | |
References | () https://www.elastic.co/community/security - Vendor Advisory | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
22 Nov 2023, 03:36
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-11-22 01:15
Updated : 2024-02-05 00:22
NVD link : CVE-2021-22150
Mitre link : CVE-2021-22150
CVE.ORG link : CVE-2021-22150
JSON object : View
Products Affected
elastic
- kibana
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')