Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-11482

The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.

Published

2017-12-08T18:29:00.273

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 6.1 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

4.9

Weaknesses
  • Type: Secondary
    CWE-601
  • Type: Primary
    CWE-601
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application elastic kibana 5.6.0 Yes
Application elastic kibana 5.6.1 Yes
Application elastic kibana 5.6.2 Yes
Application elastic kibana 5.6.3 Yes
Application elastic kibana 5.6.4 Yes
Application elastic kibana 6.0.0 Yes
Application elastic kibana 6.0.0 Yes
Application elastic kibana 6.0.0 Yes
Application elastic kibana 6.0.0 Yes
Application elastic kibana 6.0.0 Yes
Application elastic kibana 6.0.0 Yes
Application elastic kibana 6.0.0 Yes
References