CVE-2021-22141
published 2022-11-18CVE-2021-22141: An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.54%
41.1th percentile
An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | < 6.8.16 | 6.8.16 |
| elastic | kibana | — | — |
| elastic | kibana | >= 7.0.0 < 7.13.0 | 7.13.0 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kibana: URL redirection flaw
vendor_redhat·2021-05-25·CVSS 6.1
CVE-2021-22141 [MEDIUM] CWE-601 kibana: URL redirection flaw
kibana: URL redirection flaw
An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.
An open redirect flaw was found in Kibana. An attacker is able to redirect a logged Kibana user to an arbitrary website by specially crafted URL.
Statement: OpenShift Container Platform (OCP) 4 delivered the kibana package but during the update to container first (openshift4/ose-logging-kibana6 since OCP 4.5) the kibana package is not maintained anymore, hence is marked as wontfix.
Package: openshift-logging/kibana6-rhel8 (Logging Subsystem for Red Hat OpenShift) - Fix deferred
Package: kibana (Red Hat OpenShift Container Platform 3.11) - Fix deferred
Pack
GHSA
GHSA-whx6-754g-3x5v: An open redirect flaw was found in Kibana versions before 7
ghsa_unreviewed·2022-11-19
CVE-2021-22141 [MEDIUM] CWE-601 GHSA-whx6-754g-3x5v: An open redirect flaw was found in Kibana versions before 7
An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-11-18
Published