CVE-2020-27816

2020-12-0200:54:03

CWE-601

redhat

www.cve.org

0.001 Low

EPSS

Percentile

34.0%

JSON

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7.

CNA Affected

[
  {
    "product": "openshift-logging/console",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Versions before elasticsearch-operator-container 4.7"
      }
    ]
  }
]

References

bugzilla.redhat.com/show_bug.cgi?id=1902698

0.001 Low

EPSS

Percentile

34.0%

JSON

Related for CVELIST:CVE-2020-27816