CVE-2021-37939: Cleartext Transmission of Sensitive Information

May 24, 2022 (updated July 11, 2023)

It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connectors to view limited HTTP response data on hosts accessible to the cluster.

References

discuss.elastic.co/t/kibana-7-15-2-security-update/288923
github.com/advisories/GHSA-hp5f-qqrw-c8gj
nvd.nist.gov/vuln/detail/CVE-2021-37939

Code Behaviors & Features

Detect and mitigate CVE-2021-37939 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →