CVE-2024-23442 — Open Redirect in Kibana

CWE-601 — Open Redirect4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.4%
top 38.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Kibana
Timeline
PublishedJun 14

Description

An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDelastic/kibana8.0.0 — 8.14.0+1
▶CVEListV5elastic/kibana8.11.1 — 8.13.4+1

🔴Vulnerability Details

2
GHSA
GHSA-w7hw-fm35-mf9m: An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted K↗2024-06-14
▶
CVEList
Kibana open redirect issue↗2024-06-14
▶

📋Vendor Advisories

1
Red Hat
kibana: Open Redirect Issue↗2024-06-14
▶
CVE-2024-23442 — Open Redirect in Elastic Kibana | cvebase