Vulnerability · Published Dec 2, 2020 · Assigned by redhat

CVE-2020-27816

Medium 6.1

In plain English

A medium-severity open redirect in openshift-logging/console. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities).

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)0.7%top 48.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7.

Affected products (as reported)

Vendor	Product	Versions
n/a	openshift-logging/console	Versions before elasticsearch-operator-container 4.7

Weakness: CWE-601

References

https://bugzilla.redhat.com/show_bug.cgi?id=1902698 x_refsource_MISC