PT-2021-9173 · Openshift Container Platform · Kibana

Jason Shepherd · Published 2020-07-14 · Updated 2023-02-12 · CVE-2020-10743

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenShift Container Platform's distribution of Kibana (affected versions not specified)

Description A flaw in OpenShift Container Platform's distribution of Kibana allows it to be opened in an iframe, enabling an attacker to intercept and manipulate requests. This issue can be exploited to trick a user into performing arbitrary actions in Kibana, such as clickjacking.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improperly Implemented Security Check for Standard

Clickjacking

Weakness Enumeration

CWE-358

CWE-1021

Related Identifiers

CVE-2020-10743

SUSE-RU-2020:2072-1

SUSE-RU-2020:2161-1

SUSE-RU-2021:0351-1

SUSE-SU-2020:1901-1

SUSE-SU-2021:1962-1

Affected Products

Kibana

References · 168

• https://osv.dev/vulnerability/SUSE-SU-2021:1962-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2021:0351-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1834550 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2020:2072-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10743 · Security Note
• https://osv.dev/vulnerability/SUSE-RU-2020:2161-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10743 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1901-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2020-8151 · Note
• https://suse.com/security/cve/CVE-2021-21238 · Note
• https://suse.com/security/cve/CVE-2021-23336 · Note
• https://bugzilla.suse.com/1083903 · Note
• https://suse.com/security/cve/CVE-2020-5313 · Note
• https://suse.com/security/cve/CVE-2019-3498 · Note
• https://suse.com/security/cve/CVE-2019-16785 · Note