GHSA-hp5f-qqrw-c8gj

Kibana Sensitive Data Disclosure

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-37939

Packages

Ecosystem	Package	Affected	Fixed in
npm	kibana	>= 7.8.0, < 7.15.2	7.15.2

Details

As written in the advisory (Markdown source, shown as plain text).

It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connectors to view limited HTTP response data on hosts accessible to the cluster.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-37939 advisory
https://discuss.elastic.co/t/kibana-7-15-2-security-update/288923 web