CVE-2018-3819CWE-601

The fix in Kibana for ESA-2017-23 was incomplete

published March 30, 2018

CVSS
—
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00836 · 57.3th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2018-03-30T20:00Z
EPSS history
Timeline
  • 30 MAR 20:00Z
    The fix in Kibana for ESA-2017-23 was incomplete
    cvelistv5