GHSA-hp5f-qqrw-c8gj

Source

https://github.com/advisories/GHSA-hp5f-qqrw-c8gj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hp5f-qqrw-c8gj/GHSA-hp5f-qqrw-c8gj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hp5f-qqrw-c8gj

Aliases

CVE-2021-37939

Published

2022-05-24T22:28:42Z

Modified

2023-11-08T04:06:24.879869Z

Summary

Kibana Sensitive Data Disclosure

Details

It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connectors to view limited HTTP response data on hosts accessible to the cluster.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-11T18:24:03Z",
    "severity": "MODERATE",
    "nvd_published_at": "2021-11-18T16:15:00Z",
    "cwe_ids": [
        "CWE-319"
    ]
}

References

Affected packages

npm / kibana

Package

Name: kibana; View open source insights on deps.dev
Purl: pkg:npm/kibana

Affected ranges

Type: SEMVER
Events: Introduced

7.8.0

Fixed

7.15.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hp5f-qqrw-c8gj/GHSA-hp5f-qqrw-c8gj.json"

last_known_affected_version_range

"<= 7.15.1"