CVE-2021-22139

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-22139
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22139.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-22139
Published
2021-05-13T18:15:09.120Z
Modified
2026-04-10T04:29:57.887570Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host connection pool, making Kibana unavailable for all other users.

References

Affected packages

Git / github.com/elastic/kibana

Affected ranges

Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
abb04c5543d2201630c9669fe3680864506d924e
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.12.1"
        }
    ]
}

Affected versions

7.*
7.0-known-good
v4.*
v4.0.0-beta1
v4.0.0-beta1.1
v4.0.0-beta2
v4.0.0-beta3
v4.2.0-beta1
v5.*
v5.0.0-alpha5
v6.*
v6.0.0-alpha1
v6.0.0-alpha2
v7.*
v7.0.0-alpha1
v7.0.0-alpha2
v7.12.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22139.json"