Elastic Kibana any version

Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments

Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise

Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring

Kibana server-side request forgery

Kibana Improper Authorization

Kibana Origin Validation Error

Kibana Improper Authorization

Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connectors to view limited HTTP response data on hosts accessible to the cluster.

In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected. This was caused by background polling activities unintentionally extending authenticated users sessions, preventing a user session from timing out.