Description
With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions.
Remediation
References
https://www.elastic.co/community/security
Related Vulnerabilities
CVE-2022-36899 Vulnerability in maven package com.compuware.jenkins:compuware-ispw-operations
CVE-2016-3093 Vulnerability in maven package com.opensymphony:xwork-core
CVE-2020-11996 Vulnerability in maven package org.apache.tomcat:tomcat-coyote
CVE-2020-2274 Vulnerability in maven package org.jenkins-ci.plugins:elastestv
CVE-2017-12625 Vulnerability in maven package org.apache.hive.hcatalog:hive-hcatalog-core