products / kibana
Kibana
Kibana is the visualization and analytics layer for the Elastic stack. It exposes the full Elasticsearch dataset through dashboards and search interfaces. NVD tracks it as elastic:kibana with dotted stack versions (7.x, 8.x). Pairs with Elasticsearch and Logstash coverage.
api usage
Querying Kibana
product slug
kibanaversion format
7.10.0, 8.11.1bash
curl "https://api.attestd.io/v1/check?product=kibana&version=7.10.0" \
-H "Authorization: Bearer $ATTESTD_KEY"Kibana 7.10.0 is affected by CVE-2021-22141 (stored XSS in Kibana dashboard features). The response shows risk_state: "high".
json
{
"product": "kibana",
"version": "7.10.0",
"supported": true,
"risk_state": "high",
"risk_factors": [
"remote_code_execution",
"no_authentication_required",
"internet_exposed_service",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": null,
"confidence": 0.5,
"cve_ids": [
"CVE-2021-22136",
"CVE-2021-22139",
"CVE-2021-22141",
"CVE-2021-22142",
"CVE-2021-22151",
"CVE-2021-37936",
"CVE-2021-37938",
"CVE-2021-37939",
"CVE-2022-23707",
"CVE-2022-23709",
"CVE-2022-23711",
"CVE-2022-23713",
"CVE-2022-38778",
"CVE-2022-38779",
"CVE-2024-23442",
"CVE-2024-23443",
"CVE-2024-37281",
"CVE-2024-37287",
"CVE-2024-43706",
"CVE-2024-43708",
"CVE-2024-52972",
"CVE-2024-52973",
"CVE-2025-25009",
"CVE-2025-25012",
"CVE-2025-25017",
"CVE-2025-25018",
"CVE-2025-37732",
"CVE-2025-68385",
"CVE-2025-68386",
"CVE-2025-68387",
"CVE-2025-68389",
"CVE-2025-68422",
"CVE-2026-0528",
"CVE-2026-0530",
"CVE-2026-0531",
"CVE-2026-0543",
"CVE-2026-49091"
],
"cves": null,
"max_epss": 0.01764,
"last_updated": "2026-07-26T06:40:14.199894Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}safe version
Kibana 8.15.0 includes the upstream fixes for CVE-2021-22141.
bash
curl "https://api.attestd.io/v1/check?product=kibana&version=8.19.19" \
-H "Authorization: Bearer $ATTESTD_KEY"notable cves
CVE history
Kibana CVE history includes server-side request forgery in connector plugins, stored cross-site scripting in dashboard and canvas features, and prototype pollution in query parsing.
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2021-22141 | Stored cross-site scripting in Kibana dashboard and visualization features via crafted index patterns. | 7.10.0 to 7.10.6 | 8.8 |
CVE-2019-7616 | Server-side request forgery in Kibana Timelion and connector plugins allowing internal network probing. | before 6.6.2 | 7.2 |
CVE-2021-22134 | Information disclosure via Kibana reporting API exposing document field data. | 7.11.0 to 7.11.2 | 6.5 |
CVE-2020-7012 | Cross-site scripting in Kibana Maps and Canvas features. | 7.0.0 to 7.6.2 | 6.1 |
CVE-2023-31417 | Prototype pollution in Kibana query parsing leading to denial of service. | see NVD | 7.5 |
related