| Package | Affected versions | Patched versions |
|---|---|---|
| kibana | ≥ 9.0.0, < 9.2.8≥ 9.3.0, < 9.3.2 | 9.2.89.3.2 |
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free