CVE-2021-22150

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-22150

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22150.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-22150

Published

2023-11-22T01:15:07.417Z

Modified

2026-07-09T00:12:40.070513Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.

References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type

GIT

Repo

https://github.com/elastic/elasticsearch

Events

Introduced

747e1cc71def077253878a59143c1f785afa92b9

Fixed

66b55ebfa59c92c15db3f69a335d500018b3331e

Database specific

{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "7.10.2"
        },
        {
            "fixed": "7.14.1"
        }
    ]
}

Database specific

vanir_signatures

[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "43294031746314926808366686240993485436",
                "72129461379004843922361447629433292739",
                "299165755059523955650530030949892518246",
                "320210725232441693312032919881270238173",
                "293303421246874422341572304132211700069",
                "58470013856907099080964870509330781875",
                "296999303062807072169658683471145993999",
                "300591473658675280601341069790004290678",
                "160188011084836964071373289530966569573",
                "143233807439995617848796493011994450856",
                "6350947991896534955236864498512922585",
                "237982936089500951464304433795246576"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e",
        "signature_type": "Line",
        "target": {
            "file": "modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloader.java"
        },
        "id": "CVE-2021-22150-1f3d38a5",
        "deprecated": false
    },
    {
        "digest": {
            "length": 336.0,
            "function_hash": "123008238293448310980674592781724958548"
        },
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e",
        "signature_type": "Function",
        "target": {
            "function": "setEnabled",
            "file": "modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloaderTaskExecutor.java"
        },
        "id": "CVE-2021-22150-43ea594e",
        "deprecated": false
    },
    {
        "digest": {
            "length": 564.0,
            "function_hash": "260663371080659251893305562102741669443"
        },
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e",
        "signature_type": "Function",
        "target": {
            "function": "GeoIpDownloader",
            "file": "modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloader.java"
        },
        "id": "CVE-2021-22150-5b8218ed",
        "deprecated": false
    },
    {
        "digest": {
            "length": 245.0,
            "function_hash": "123277663807363208651257303326478525497"
        },
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e",
        "signature_type": "Function",
        "target": {
            "function": "clusterChanged",
            "file": "modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloaderTaskExecutor.java"
        },
        "id": "CVE-2021-22150-5c4d153f",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "291110225617448284938680460363260256557",
                "141322434359827214491010619852413737624",
                "18722184183482606797300801913160473935",
                "84759085196698385649541736620428937369",
                "330736549659086272716201033219146970443",
                "78938860815427841495704971172327648809",
                "285329995835112589973388027222669394563",
                "308421632650885990509851682624100988750",
                "303805532460993261979200839405425225042",
                "5328311121646375897315212467096655922",
                "112968698024351385830166669336685651681",
                "281215882580579346575059810248021011719",
                "319189154037564604934153396664531384113",
                "149228605690654109618796387525272814806",
                "312703810024447475870610295586135527405",
                "158289000336674805338813453430308797437",
                "275273013179566745131735790247575047584",
                "290562535040322731431913367590119185031",
                "170283097830717693710483563365076558732",
                "274535963129894068371486967338432527913",
                "141256808549946728103583726782147456903",
                "39829565313391319809867072905663955397",
                "117841172245403898421918867895955408564",
                "309893578793894113566889101490578155085",
                "9088804385998371460488616185024685970",
                "77162977922016855688716612164253048516",
                "287212268032535206145107662754875763708",
                "78657904124391617966875539569913380237",
                "266134255359683549727298029806145014753",
                "320917847787903113653131708863413722636",
                "230838848098826085779033406560455529229",
                "7190067002162824531458144305361982292",
                "143427756424031091036021574847113415950",
                "215953566906267560006086642159505105876",
                "112979444913582689794012941559410702716",
                "89195688825346920342376358263314388443",
                "43238398256300634246693563742953588208",
                "10333928841560312002208969018516952856",
                "79888031617470547464557005022838001819",
                "292060965530350989376832212592275356366",
                "287348193867920464580007650220885527509",
                "230557132420537145711011838631804784031",
                "9034221530883613317087008010030791152",
                "274388618104218543508567763726510483529",
                "128148356571720265980502854100028628708",
                "58510716701492134555691472698889597316",
                "150244817892521442448313353254543857320",
                "60519532783079146443603676488130403839",
                "171124365331192943670559863338206056437",
                "66560627416304229224651317592802479305",
                "204532021424519538519357313830239766201",
                "45066071883776509565833363839531387162"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e",
        "signature_type": "Line",
        "target": {
            "file": "modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloaderTaskExecutor.java"
        },
        "id": "CVE-2021-22150-6d7e4268",
        "deprecated": false
    },
    {
        "digest": {
            "length": 233.0,
            "function_hash": "180057013320988624966896474695678749292"
        },
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e",
        "signature_type": "Function",
        "target": {
            "function": "nodeOperation",
            "file": "modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloaderTaskExecutor.java"
        },
        "id": "CVE-2021-22150-eae83c1a",
        "deprecated": false
    },
    {
        "digest": {
            "length": 478.0,
            "function_hash": "52233103973581432341793139102182098894"
        },
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e",
        "signature_type": "Function",
        "target": {
            "function": "GeoIpDownloaderTaskExecutor",
            "file": "modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloaderTaskExecutor.java"
        },
        "id": "CVE-2021-22150-f56dfdd1",
        "deprecated": false
    }
]

vanir_signatures_modified

"2026-07-09T00:12:40Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22150.json"

Git / github.com/elastic/kibana