CVE-2017-11482: Medium severity elastic vulnerability

Published Dec 8, 2017

Updated

The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.

Affected Software

12 affected components

Elastic Kibana=5.6.0

Elastic Kibana=5.6.1

Elastic Kibana=5.6.2

Elastic Kibana=5.6.3

Elastic Kibana=5.6.4

Elastic Kibana=6.0.0

Elastic Kibana=6.0.0-alpha1

Elastic Kibana=6.0.0-alpha2

Elastic Kibana=6.0.0-beta1

Elastic Kibana=6.0.0-beta2

Elastic Kibana=6.0.0-rc1

Elastic Kibana=6.0.0-rc2

Event History

Dec 8, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2017-11482?

CVE-2017-11482 is an open redirect vulnerability in Kibana versions before 6.0.1 and 5.6.5.

How does CVE-2017-11482 affect Elastic Kibana?

CVE-2017-11482 affects Elastic Kibana versions 5.6.0 to 5.6.4 and 6.0.0 to 6.0.0-rc2 when X-Pack is installed.

What is the severity of CVE-2017-11482?

The severity of CVE-2017-11482 is medium with a severity value of 6.1.

How can I fix CVE-2017-11482?

To fix CVE-2017-11482, upgrade Kibana to version 6.0.1 or 5.6.5, or apply the necessary security update.

Where can I find more information about CVE-2017-11482?

You can find more information about CVE-2017-11482 at the following link: https://discuss.elastic.co/t/kibana-6-0-1-and-5-6-5-security-update/110571