CVE-2020-27816: The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original…

medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
elastic	kibana	<= 4.7	—
openshift-logging	console	—	—
redhat	openshift_container_platform	—	—