GitHub Advisoryadvisory · npm

GHSA-hp5f-qqrw-c8gj Kibana Sensitive Data Disclosure

MEDIUM Published 2022-05-24 Modified 2023-07-11 Official page ↗
Aliases
CVE-2021-37939
Ecosystem
npm
Packages
kibana
Severity
Moderate
Weaknesses
CWE-319
Reviewed
2023-07-11

Affected packages

• npm kibana: >= 7.8.0, < 7.15.2 → fixed in 7.15.2

Description

It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connectors to view limited HTTP response data on hosts accessible to the cluster.

Related

Alias · CVE (1)

  • CVE-2021-37939 It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts,… vulnerability

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References