Elastic Kibana
Approved changes feed: RSS · Atom
cpe:2.3:a:elastic:kibana:-:*:*:*:*:*:*:*
part: a version: - update: *
| Vendor | Elastic (1d0b8d2a-fd47-5b20-b005-34326f9bd037) |
|---|---|
| Product | Kibana (c13ee88f-9cd3-57c3-8d6e-bbf4a9872328) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/elastic/kibana |
purl2cpe | 2026-06-01 10:15:15.203105 |
pkg:github/elastic/kibana |
purl2cpe | 2026-06-01 10:15:15.203107 |
pkg:rpm/opensuse/kibana |
purl2cpe | 2026-06-01 10:15:15.203109 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-37285 |
vulnerable | 2026-06-03 14:56:06.245099 |
Kibana arbitrary code execution via YAML deserialization
CRITICAL (9.1)
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html assigned to them.
The following Elasticsearch indices permissions are required
* write privilege on the system indices .kibana_ingest*
* The allow_restricted_indices flag is set to true
Any of the following Kibana privileges are additionally required
* Under Fleet the All privilege is granted
* Under Integration the Read or All privilege is granted
* Access to the fleet-setup privilege is gained through the Fleet Server’s service account token
Published: 2024-11-14T16:49:16.594Z
Updated: 2024-11-14T18:48:27.837Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-10743 |
vulnerable | 2026-06-03 14:41:00.488680 |
Details available
It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests. This flaw allows an attacker to trick a user into performing arbitrary actions in OCP's distribution of Kibana, such as clickjacking.
Published: 2021-06-02T10:54:17.000Z
Updated: 2024-08-04T11:14:14.983Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.