Description

With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.

Remediation

References

https://www.elastic.co/community/security

Related Vulnerabilities

CVE-2020-2228 Vulnerability in maven package org.jenkins-ci.plugins:gitlab-oauth

CVE-2020-16015 Vulnerability in npm package electron

CVE-2015-8862 Vulnerability in npm package mustache

CVE-2023-29209 Vulnerability in maven package org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro

CVE-2021-36739 Vulnerability in maven package org.apache.portals.pluto.archetype:mvcbean-jsp-portlet-archetype

Severity

High

Classification

CWE-601 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Vendor Advisory