CVE-2020-27816
02.12.2020, 01:15
The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7.
Vendor | Product | Version |
---|---|---|
elastic | kibana | 𝑥 ≤ 4.7 |
redhat | openshift_container_platform | 4.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration