Vulnerability Description
It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Kibana | < 7.14.1 |
Related Weaknesses (CWE)
References
- https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077MitigationVendor Advisory
- https://www.elastic.co/community/security/MitigationVendor Advisory
- https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077MitigationVendor Advisory
- https://www.elastic.co/community/security/MitigationVendor Advisory
FAQ
What is CVE-2021-37936?
CVE-2021-37936 is a vulnerability with a CVSS score of 5.4 (MEDIUM). It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inj...
How severe is CVE-2021-37936?
CVE-2021-37936 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-37936?
Check the references section above for vendor advisories and patch information. Affected products include: Elastic Kibana.