Описание
Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.
A flaw was found in Kibana's logging functionality. If custom logging output was configured in Kibana, private user data could be written to the Kibana log files. A system attacker could use this data to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools | kibana | Will not fix | ||
| Red Hat OpenStack Platform 10 (Newton) Operational Tools | kibana | Not affected | ||
| Red Hat OpenStack Platform 8 (Liberty) Operational Tools | kibana | Will not fix | ||
| Red Hat OpenStack Platform 9 (Mitaka) Operational Tools | kibana | Will not fix | ||
| Red Hat OpenShift Container Platform 3.2 | kibana | Fixed | RHSA-2016:1836 | 08.09.2016 |
| Red Hat OpenShift Container Platform 3.2 | openshift-elasticsearch-plugin | Fixed | RHSA-2016:1836 | 08.09.2016 |
| Red Hat OpenShift Enterprise 3.1 | kibana | Fixed | RHSA-2016:1836 | 08.09.2016 |
| Red Hat OpenShift Enterprise 3.1 | openshift-elasticsearch-plugin | Fixed | RHSA-2016:1836 | 08.09.2016 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.8 Medium
CVSS3
4.1 Medium
CVSS2
Связанные уязвимости
Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.
Kibana before 4.5.4 and 4.1.11 when a custom output is configured for ...
Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.
EPSS
4.8 Medium
CVSS3
4.1 Medium
CVSS2