Описание
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.
Уязвимые конфигурации
Одно из
EPSS
7.7 High
CVSS3
Дефекты
Связанные уязвимости
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated u ...
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.
EPSS
7.7 High
CVSS3