Description

The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.

Remediation

References

https://discuss.elastic.co/t/kibana-6-0-1-and-5-6-5-security-update/110571

Related Vulnerabilities

CVE-2014-9635 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2023-37909 Vulnerability in maven package org.xwiki.platform:xwiki-platform-menu-ui

CVE-2020-16015 Vulnerability in maven package org.webjars.npm:electron

CVE-2020-7599 Vulnerability in maven package com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin

CVE-2017-4963 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-server

Severity

High

Classification

CWE-601 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Vendor Advisory