CyberRota Analysis
AI-GeneratedKibana is vulnerable to a relative path traversal flaw that allows attackers to manipulate user-supplied identifiers, potentially leading to unauthorized deletion of Kibana resources. This vulnerability poses a significant risk to organizations using Kibana for data visualization and analysis, as it can compromise the integrity of their configurations. Users of Kibana, especially those managing Fleet Server host configurations, should prioritize immediate remediation to mitigate the risk of exploitation.
Original NVD Description
Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.