PT-2019-13335 · Search Guard · Search Guard Kibana Plugin

Publicado 2019-08-23 · Atualizado 2020-10-08 · CVE-2019-13423

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Search Guard Kibana Plugin versions before 5.6.8-7 Search Guard Kibana Plugin versions before 6.x.y-12

Description The issue allows an authenticated Kibana user to impersonate as the kibanaserver user when providing wrong credentials under specific conditions. These conditions include: Kibana being configured to use Single-Sign-On as the authentication method with one of Kerberos, JWT, Proxy, or Client certificate; the kibanaserver user being configured to use HTTP Basic as the authentication method; and Search Guard being configured to use an SSO authentication domain and HTTP Basic at the same time.

Recommendations For Search Guard Kibana Plugin versions before 5.6.8-7, update to version 5.6.8-7 or later to resolve the issue. For Search Guard Kibana Plugin versions before 6.x.y-12, update to version 6.x.y-12 or later to resolve the issue. As a temporary workaround, consider disabling the use of HTTP Basic authentication for the kibanaserver user until a patch is available. Restrict access to the SSO authentication domain to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2019-13423

Produtos afetados

Search Guard Kibana Plugin

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-13423 · Aviso do Fabricante
• https://search-guard.com/cve-advisory · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13423 · Nota de Segurança
• https://docs.search-guard.com/6.x-25/changelog-kibana-6.x-12 · Aviso do Fabricante