CVE-2021-22139 Denial of service in Kibana
An attacker with webhook creation permissions can exhaust connection pools, causing a denial of service for all Kibana users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22139?
CVE-2021-22139 is a medium-severity denial of service vulnerability in Elastic Kibana, published on 13 May 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host connection pool, making Kibana unavailable for all other users.
Weakness: CWE-400
Which versions are affected by CVE-2021-22139?
It affects 1 product.
Products include Elastic Kibana.
How do I fix CVE-2021-22139?
No fix has been published for CVE-2021-22139 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-22139 being exploited?
There is no known exploitation of CVE-2021-22139 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as GHSA-823g-p8g4-q559.