Elastic Kibana

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Improper Input Validation in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure

Improper Input Validation in Kibana Fleet Leading to Privilege Escalation

Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation

Uncaught Exception in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service

Kibana Denial of Service issue

An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.

Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions

Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization in Kibana Leading to Information Disclosure

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.

Kibana allocation of resources without limits or throttling leads to crash

Kibana allocation of resources without limits or throttling leads to crash

Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration

Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys

Allocation of Resources Without Limits or Throttling in Kibana Leading to Excessive Allocation

Kibana Allocation of Resources Without Limits or Throttling

Kibana privilege escalation via reporting_user role

Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion

Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions

Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.

Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a link in the Kibana domain that redirects to an arbitrary website.