What is CVE-2021-37939?

CVE-2021-37939 is a low-severity vulnerability in Elastic Kibana, classified under Information Disclosure. CVSS score: 2.7/10. Published 2021-11-18.

How severe is CVE-2021-37939?

Low severity. CVSS v3 base score is 2.7 out of 10.

Information disclosure in Elastic Kibana

CVE-2021-37939

It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connectors to view limited HTTP response data on hosts accessible to the cluster.

Vulnerability class: Information Disclosure

EPSS: 0.004 (36.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.

Affected products

Elastic Kibana — versions All versions from 7.8.0 through 7.15.1

Weakness classification (CWE)

References

security@elastic.co (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-37939?: CVE-2021-37939 is a low-severity vulnerability in Elastic Kibana, classified under Information Disclosure. CVSS score: 2.7/10. Published 2021-11-18.
How severe is CVE-2021-37939?: Low severity. CVSS v3 base score is 2.7 out of 10.