Bug 2148121 (CVE-2021-37936)

Summary:	CVE-2021-37936 kibana: HTML injection issue (ESA-2021-23)
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, chazlett, eglynn, gmalinko, janstey, jcantril, jjoyce, jpavlik, jschluet, jwon, lhh, mburns, mgarciac, periklis, rhos-maint, slinaber, spower, tvignaud
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kibana 7.14.1	Doc Type:	---
Doc Text:	A flaw was found in Kibana. This issue occurs due to Kibana not sanitizing document fields containing HTML snippets. An attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-08 03:32:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2144437

Description Avinash Hanwate 2022-11-24 12:57:56 UTC

It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.

https://www.elastic.co/community/security/
https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077

Comment 1 Product Security DevOps Team 2022-12-08 03:32:48 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-37936