CVE-2016-10364

2017-06-1621:29:00

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.4%

JSON

With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions.

CPENameOperatorVersion
elasticsearcheq0.19.0
elasticsearcheq0.90.0.RC1
elasticsearcheq4.2.0-beta1
elasticsearcheq0.19.0.RC2
elasticsearcheq0.19.0.RC3
elasticsearcheq4.0.0
elasticsearcheq0.10.0
elasticsearcheq0.90.0.Beta1
elasticsearcheq5.0.0-alpha1
elasticsearcheq0.18.0

Name	Operator	Version
elasticsearch	eq	0.19.0
elasticsearch	eq	0.90.0.RC1
elasticsearch	eq	4.2.0-beta1
elasticsearch	eq	0.19.0.RC2
elasticsearch	eq	0.19.0.RC3
elasticsearch	eq	4.0.0
elasticsearch	eq	0.10.0
elasticsearch	eq	0.90.0.Beta1
elasticsearch	eq	5.0.0-alpha1
elasticsearch	eq	0.18.0