CVE-2017-8451
published 2017-06-16CVE-2017-8451: With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that…
PriorityP422medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
0.90%
55.3th percentile
With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elastic_x-pack_security | — | — |
| elastic | kibana | <= 5.3.0 | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r58v-fqqp-24p8: With X-Pack installed, Kibana versions before 5
ghsa_unreviewed·2022-05-13
CVE-2017-8451 [MEDIUM] CWE-601 GHSA-r58v-fqqp-24p8: With X-Pack installed, Kibana versions before 5
With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.
GHSA
GHSA-28c3-wp2j-prjr: The Kibana fix for CVE-2017-8451 was found to be incomplete
ghsa_unreviewed·2022-05-13·CVSS 6.1
CVE-2017-11482 [MEDIUM] CWE-601 GHSA-28c3-wp2j-prjr: The Kibana fix for CVE-2017-8451 was found to be incomplete
The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.
Red Hat
kibana: open redirect on the login page (ESA-2017-23)
vendor_redhat·2017-12-17·CVSS 6.1
CVE-2017-11482 [MEDIUM] CWE-601 kibana: open redirect on the login page (ESA-2017-23)
kibana: open redirect on the login page (ESA-2017-23)
The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.
Package: kibana (Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools) - Not affected
Package: hawtio-kibana (Red Hat JBoss Fuse 6) - Not affected
Package: kibana (Red Hat OpenShift Enterprise 3) - Will not fix
Package: puppet-kibana3 (Red Hat OpenStack Platform 10 (Newton)) - Not affected
Package: puppet-kibana3 (Red Hat OpenStack Platform 11 (Ocata)) - Not affected
Package: puppet-kibana3 (Red Hat OpenStack Platform 12 (Pike)) - Not affected
Package:
Red Hat
kibana: open redirect on the login page (ESA-2017-04 )
vendor_redhat·2017-04-20·CVSS 6.1
CVE-2017-8451 [MEDIUM] CWE-601 kibana: open redirect on the login page (ESA-2017-04 )
kibana: open redirect on the login page (ESA-2017-04 )
With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.
Package: kibana (Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools) - Not affected
Package: hawtio-kibana (Red Hat JBoss Fuse 6) - Not affected
Package: kibana (Red Hat OpenShift Enterprise 3) - Will not fix
Package: puppet-kibana3 (Red Hat OpenStack Platform 10 (Newton)) - Not affected
Package: puppet-kibana3 (Red Hat OpenStack Platform 11 (Ocata)) - Not affected
Package: puppet-kibana3 (Red Hat OpenStack Platform 12 (Pike)) - Not affected
Package: kibana (Red Hat OpenStack Platform 8 (Liberty) Operational Tools) - No
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-8451 puppet-kibana3: kibana: open redirect on the login page (ESA-2017-04 ) [openstack-rdo]
bugzilla·2018-01-25·CVSS 6.1
CVE-2017-8451 [MEDIUM] CVE-2017-8451 puppet-kibana3: kibana: open redirect on the login page (ESA-2017-04 ) [openstack-rdo]
CVE-2017-8451 puppet-kibana3: kibana: open redirect on the login page (ESA-2017-04 ) [openstack-rdo]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of openstack-rdo.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
The associate
Bugzilla
CVE-2017-11482 kibana: open redirect on the login page (ESA-2017-23)
bugzilla·2018-01-25·CVSS 6.1
CVE-2017-11482 [MEDIUM] CVE-2017-11482 kibana: open redirect on the login page (ESA-2017-23)
CVE-2017-11482 kibana: open redirect on the login page (ESA-2017-23)
The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.
References:
https://discuss.elastic.co/t/kibana-6-0-1-and-5-6-5-security-update/110571
Discussion:
Created puppet-kibana3 tracking bugs for this issue:
Affects: openstack-rdo [bug 1538797]
Bugzilla
CVE-2017-8451 kibana: open redirect on the login page (ESA-2017-04 )
bugzilla·2018-01-25·CVSS 6.1
CVE-2017-8451 [MEDIUM] CVE-2017-8451 kibana: open redirect on the login page (ESA-2017-04 )
CVE-2017-8451 kibana: open redirect on the login page (ESA-2017-04 )
With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website. Shield versions for Kibana prior to 2.4.5 are also affected.
References:
https://www.elastic.co/community/security
Discussion:
Created puppet-kibana3 tracking bugs for this issue:
Affects: openstack-rdo [bug 1538802]
2017-06-16
Published