CVE-2021-22150

MEDIUM

Kibana 7.10.2-7.14.0 - Authenticated Remote Code Execution via Malicious Fleet Package Upload

Title source: llm
STIX 2.1

Description

It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.

References (2)

Core 2

Scores

CVSS v3 6.6
EPSS 0.0016
EPSS Percentile 36.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-94
Status published
Products (1)
elastic/kibana 7.10.2 - 7.14.1
Published Nov 22, 2023
Tracked Since Feb 18, 2026