Elastic Kibana any version

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources

Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts

Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.

Kibana code execution issue

Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models

Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents

Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise

Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification

Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation

Cross-site request forgery (CSRF) vulnerability in Elasticsearch Kibana before 4.1.3 and 4.2.x before 4.2.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be viewed by untrusted parties or logged into the Kibana access logs.

Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host connection pool, making Kibana unavailable for all other users.

A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.

Uncaught Exception in Kibana Leading to Denial of Service

Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Kibana Broken Access Control issue

Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service

Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources

Allocation of Resources Without Limits or Throttling in Kibana Fleet

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Improper Input Validation in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure

Improper Input Validation in Kibana Fleet Leading to Privilege Escalation