CVE-2016-10365 — Open Redirect in Kibana

CWE-601 — Open Redirect5 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 58.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Kibana
Timeline
PublishedJun 16
Latest updateMay 13

Description

Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a link in the Kibana domain that redirects to an arbitrary website.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDelastic/kibana4.6.2+1
▶CVEListV5elastic/kibanabefore 5.0.1 and 4.6.3

🔴Vulnerability Details

2
GHSA
GHSA-jhcr-83jp-pjvr: Kibana versions before 4↗2022-05-13
▶
CVEList
CVE-2016-10365: Kibana versions before 4↗2017-06-16
▶

📋Vendor Advisories

1
Red Hat
kibana: Open redirect vulnerability (ESA-2016-09)↗2016-11-15
▶

💬Community

1
Bugzilla
CVE-2016-10365 kibana: Open redirect vulnerability (ESA-2016-09)↗2016-11-16
▶
CVE-2016-10365 — Open Redirect in Elastic Kibana | cvebase