Description
With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions.
Remediation
References
https://www.elastic.co/community/security
Related Vulnerabilities
CVE-2013-4590 Vulnerability in maven package org.apache.tomcat:tomcat-jasper
CVE-2023-32991 Vulnerability in maven package io.jenkins.plugins:miniorange-saml-sp
CVE-2022-34194 Vulnerability in maven package org.jenkins-ci.plugins:readonly-parameters
CVE-2014-0075 Vulnerability in maven package org.apache.tomcat:coyote
CVE-2023-29514 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui