CyberRota Analysis
AI-GeneratedA Cross-Site Request Forgery vulnerability in Kibana allows an attacker to exploit the visualization creation feature, enabling privilege escalation by crafting malicious Vega visualizations. When a victim opens such a visualization, it can trigger unauthorized actions within their authenticated session. Organizations using Kibana, particularly those with users who can create visualizations, should prioritize addressing this high-severity issue to mitigate potential security risks.
Original NVD Description
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.