The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7.
References
Link | Resource |
---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=1902698 | Issue Tracking Third Party Advisory |
Configurations
History
No history.
Information
Published : 2020-12-02 01:15
Updated : 2024-02-28 18:08
NVD link : CVE-2020-27816
Mitre link : CVE-2020-27816
CVE.ORG link : CVE-2020-27816
JSON object : View
Products Affected
redhat
- openshift_container_platform
elastic
- kibana
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')