CVE-2021-37939 Kibana Sensitive Data Disclosure
A malicious user with connector creation privileges can exploit Kibana's JIRA and IBM Resilient connectors to view internal HTTP response data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-37939?
CVE-2021-37939 is a low-severity server-side request forgery vulnerability in Elastic Kibana, published on 18 Nov 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connectors to view limited HTTP response data on hosts accessible to the cluster.
Which versions are affected by CVE-2021-37939?
2 open source packages ship an affected version, including kibana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kibana npm | From 7.8.0 | 7.15.2 |
kibana npm | From 7.8.0 | 7.15.2 |
Products include Elastic Kibana.
How do I fix CVE-2021-37939?
Upgrade kibana to 7.15.2 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-37939 being exploited?
There is no known exploitation of CVE-2021-37939 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as GHSA-hp5f-qqrw-c8gj.