Vulnerability Name:

CVE-2021-22141 (CCN-240372)

Assigned:2021-05-25
Published:2021-05-25
Updated:2022-11-22
Summary:An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.
CVSS v3 Severity:6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-601
Vulnerability Consequences:Other
References:Source: MITRE
Type: CNA
CVE-2021-22141

Source: CCN
Type: Elastic Web site
Elastic Stack 7.13.0 and 6.8.16 Security Update

Source: MISC
Type: Vendor Advisory
https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964

Source: XF
Type: UNKNOWN
elastic-cve202122141-open-redirect(240372)

Source: MISC
Type: Vendor Advisory
https://www.elastic.co/community/security/

Source: CCN
Type: Mend Vulnerability Database
CVE-2021-22141

Vulnerable Configuration:Configuration 1:
  • cpe:/a:elastic:kibana:*:*:*:*:*:*:*:* (Version >= 7.0.0 and < 7.13.0)
  • OR cpe:/a:elastic:kibana:*:*:*:*:*:*:*:* (Version < 6.8.16)

    • Configuration CCN 1:
  • cpe:/a:elastic:kibana:6.8.15:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:88217
    P
    		Security update for ardana-ansible, ardana-monasca, crowbar-openstack, influxdb, kibana, openstack-cinder, openstack-ec2-api, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-keystone, openstack-neutron-gbp, openstack-nova, python-eventlet, rubygem-redcarpet, rubygem-puma (Moderate)
    2021-11-19
    oval:org.opensuse.security:def:88534
    P
    		Security update for ardana-ansible, ardana-monasca, crowbar-openstack, influxdb, kibana, openstack-cinder, openstack-ec2-api, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-keystone, openstack-neutron-gbp, openstack-nova, python-eventlet, rubygem-redcarpet, rubygem-puma (Moderate)
    2021-11-19
    BACK
    elastic kibana *
    elastic kibana *
    elastic kibana 6.8.15