SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2021-37936

Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML.

MEDIUM 5.4EPSS 0.47%

Does this matter?

Lower severity and a low EPSS score (0.47%). Track it; it rarely justifies an emergency change on its own.

Description

It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.

CVSS 3.1
5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.47% probability · 39th percentile
CISA KEV
Not listed
Weakness
CWE-79
Affected
elastic/kibana
Source
security@elastic.co

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.