Improper Input Validation Affecting kibana package, versions >=7.10.2 <7.14.1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-KIBANA-3136298
- published 20 Nov 2022
- disclosed 20 Nov 2022
- credit Unknown
Introduced: 20 Nov 2022
CVE-2021-37936 Open this link in a new tabHow to fix?
Upgrade kibana to version 7.14.1 or higher.
Overview
kibana is an open source (Apache Licensed), browser-based analytics and search dashboard for Elasticsearch.
Affected versions of this package are vulnerable to Improper Input Validation due to missing sanitizing of document fields containing HTML snippets. An attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlights a search term containing the HTML, it would be rendered for the user.
Note: The kibana package has been deprecated from NPM.
Mitigation
Users can set doc_table:highlight to false in the Kibana Advanced Settings.