CVE-2021-22142mediumCWE-1104

CVE-2021-22142: medium-severity vulnerability in Elastic Kibana

Kibana Reporting vulnerabilities

Published · Updated

Follow this CVE+ Monitor Kibana

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.6epss 1.0%
In short

Kibana's reporting feature uses an embedded Chromium browser to generate downloadable reports. If a user with report generation permissions can make this browser display malicious HTML, they could exploit known Chromium vulnerabilities to attack the system.

Technical detail

The vulnerability exists in Kibana's Reporting feature, which embeds Chromium for PDF/image generation. An authenticated attacker with report generation permissions can bypass HTML rendering protections to inject arbitrary content, potentially triggering known Chromium CVEs for privilege escalation or code execution on the Kibana server.

Summary generated and translated by AI from the official description.
Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage known Chromium vulnerabilities to conduct further attacks. Kibana contains a number of protections to prevent this browser from rendering arbitrary content.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Elastic · Kibana
Related CVEs — Elastic Kibana

In the same product, most dangerous first.

CVE-2019-7609CRITICALCVE-2019-7609EPSS 95.3%KEVCVE-2018-17246—CVE-2018-17246EPSS 84.3%CVE-2025-25014CRITICALKibana arbitrary code execution via prototype pollutionEPSS 22.3%CVE-2020-7012—CVE-2020-7012EPSS 18.2%CVE-2019-7610—CVE-2019-7610EPSS 3.9%CVE-2019-7616—CVE-2019-7616EPSS 2.4%