floragunn Search Guard Kibana Plugin Permission License and Access Control Issues Vulnerability

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , it mainly provides encryption , authentication , authorization management and log auditing and other functions . A privilege permission and access control issue vulnerability exists in floragunn...

floragunn Search Guard Kibana Plugin Input Validation Error Vulnerability

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , which mainly provides encryption , authentication , authorization management and log auditing and other functions . kibana is used in which a dashboard plug-ins . An input validation error...

floragunn Search Guard Information Disclosure Vulnerability

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , it mainly provides encryption , authentication , authorization management and log auditing and other functions . An information disclosure vulnerability exists in versions prior to floragunn Sear...

CVE-2019-13423

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong credentials when all of the following conditions a-c are true: a Kibana is configured to use Single-Sign-On as...

CVE-2019-13422

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon Kibana login...

CVE-2019-13422

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon Kibana login...

CVE-2019-13421

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...

CVE-2019-13421

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...

CVE-2019-13423

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong credentials when all of the following conditions a-c are true: a Kibana is configured to use Single-Sign-On as...

Authentication flaw

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong credentials when all of the following conditions a-c are true: a Kibana is configured to use Single-Sign-On as...

Code injection

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon Kibana login...

Default credentials

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...

CVE-2019-13422

Affected software: floragunn Search Guard Kibana Plugin; versions before 5.6.8-7 and before 6.x.y-12 have an input-validation error that can redirect a logged-in Kibana user to a potentially malicious site. Root cause per CNVD: input validation error. Impact: user redirection upon Kibana login. M...

CVE-2019-13422

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon Kibana login...

CVE-2019-13423

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong credentials when all of the following conditions a-c are true: a Kibana is configured to use Single-Sign-On as...

CVE-2019-13423

CVE-2019-13423 describes an impersonation vulnerability in floragunn Search Guard Kibana Plugin, affecting versions before 5.6.8-7 and before 6.x.y-12. The issue arises when an authenticated Kibana user presents incorrect credentials under a specific configuration: Kibana uses SSO (Kerberos, JWT,...

CVE-2019-13421

The CVE-2019-13421 affects floragunn Search Guard (Elasticsearch/ELK plug‑ins). Versions before 23.1 expose an information-disclosure flaw whereby an administrative user can retrieve bcrypt password hashes of other users from the internal user database. The issue is confirmed across multiple sour...

CVE-2019-13415

Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users can gain read access to data they are not authorized to see...

CVE-2019-13416

Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote clusters...

CVE-2019-13416

Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote clusters...