Kibana Sensitive Data Disclosure

Description

It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view.

Recommendation

Update the kibana package to the latest compatible version. Followings are version details:

• Affected version(s): >= 7.8.0, <= 7.15.1
• Patched version(s): 7.15.2

References

• GHSA-hp5f-qqrw-c8gj
• discuss.elastic.co
• CVE-2021-37939
• CWE-319
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• The AuthKit React Router Library rendered sensitive auth data in HTML - CVE-2025-55008
• Sensitive data exposure in NATS - CVE-2020-26149
• Prototype Pollution in js-data - js-data - CVE-2021-23574
• Sensitive data exposure in NATS - nats - CVE-2020-26149

You might also like:

Exploiting Server Version Disclosure

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

kibana