Uncaught Exception in Kibana Leading to Denial of Service (Elastic Kibana)
En bref
- Source
- NVD
- EPSS
- EPSS 0.52 % · centile 44 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- elastic
- Statut NVD
- Analyzed
Description
Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data. The resulting error is raised on an execution path so it propagates as an uncaught exception and terminates the Kibana process. Kibana is unavailable to all users until the service is restarted, and the condition can be triggered repeatedly.
Faiblesses (CWE)
- CWE-248 — Exception non interceptée
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | elastic |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · security@elastic.co (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-58271
- GCVE · GCVE-0-2026-72660
Avis du CERT-FR
- CERTFR-2026-AVI-1020 — Multiples vulnérabilités dans Elastic Kibana · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.19.20cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.3.8cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 9.4.0 < 9.4.5
Produits affectés
| Produit | Versions |
|---|---|
| Elastic · Kibana | affected 8.0.0 ≤ 8.19.19 ; affected 9.0.0 ≤ 9.3.7 ; affected 9.4.0 ≤ 9.4.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |