Red Hat Security AdvisoryRHSA-2016:1836
Red Hat OpenShift Enterprise Kibana security update
Released 2016-09-08 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 3.2 kibana-4.1.11-1.el7, openshift-elasticsearch-plugin-0.16.0.redhat_1-1.el7
- Red Hat OpenShift Enterprise 3.1 kibana-4.1.11-1.el7, openshift-elasticsearch-plugin-0.16.0.redhat_1-1.el7
Fixes 2 records
Priority LOW 37
Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02039 · Published 2017-06-16 · Partial fix CWE-285
Priority LOW 30
Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0115 · Published 2017-06-16 · Fixed CWE-79
