Описание
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.
A flaw was found in Kibana, where an authenticated user, through a crafted HTTP request, can exploit an Improper Authorization (CWE-285) vulnerability. This allows the user to change a document's sharing type to "global" without proper permissions. The consequence is unauthorized information disclosure, making the document visible to everyone in the space, effectively leading to a form of privilege escalation.
Отчет
This vulnerability is rated Moderate for Red Hat. An authenticated user in Kibana can exploit an improper authorization flaw to change a document's sharing type to "global" without proper permissions. This leads to unauthorized information disclosure, making the document visible to all users in the space. This affects OpenShift Container Platform via openshift-logging/kibana6-rhel8.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Logging Subsystem for Red Hat OpenShift | openshift-logging/kibana6-rhel8 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
4.3 Medium
CVSS3
Связанные уязвимости
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.
Improper Authorization (CWE-285) in Kibana can lead to privilege escal ...
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.
Уязвимость сервиса визуализации данных Kibana, связанная с ошибками авторизации, позволяющая нарушителю повысить привилегии
4.3 Medium
CVSS3