Insecure Package Upload Vulnerability in Fleet Admin Permissions

CVE-2021-22150 · HIGH Severity

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.

Learn more about our Cis Benchmark Audit For Server Software.