Read the docs
TI-2018-14692 Aliases CVE-2018-20698GHSA-6qq5-qqmc-qcxr

The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login…

Priority LOW 29CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-601.

Summary

The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login redirects on the login page when basePath is set.

Why it matters now

EPSS 0.00802 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:search-guard:search_guard:*:*:*:*:*:kibana:*:*before 6.3.0-16Vulnerablefloragunn
  • cpe:2.3:a:search-guard:search_guard:*:*:*:*:*:kibana:*:* Versions before 6.3.0-16 Vulnerable ·floragunn

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-20698
  2. 2026-10-03 Alias added: GHSA-6qq5-qqmc-qcxr

References

Patch 1

Advisory 1

  • TI-2019-10092 Improper authentication in floragunn Search Guard Kibana Plugin CVSS 3.1HIGH 8.8
  • TI-2019-10088 Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. CVSS 3.0HIGH 7.5
  • TI-2019-10087 Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. CVSS 3.1HIGH 7.5
  • TI-2019-10085 Improper authorization in floragunn Search Guard CVSS 3.1MEDIUM 6.5
  • TI-2019-10084 Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was… CVSS 3.1MEDIUM 6.5
  • TI-2019-10091 Open redirect in floragunn Search Guard Kibana Plugin CVSS 3.0MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences