search-guard-kibana-plugin: Authenticated user could impersonate server user when providing wrong credentials
Published Aug 23, 2019
8.8
HIGHCVSS 3.1
EPSS 0.68%
Description
Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong credentials when all of the following conditions a-c are true: a) Kibana is configured to use Single-Sign-On as authentication method, one of Kerberos, JWT, Proxy, Client certificate. b) The kibanaserver user is configured to use HTTP Basic as the authentication method. c) Search Guard is configured to use an SSO authentication domain and HTTP Basic at the same time
Affected products
-
- Version unspecifiedStatusaffectedConstraints<5.6.8-7
- Version unspecifiedStatusaffectedConstraints<6.x.y-12
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Floragunn | Search Guard Kibana Plugin | n/a |
|
- < 5.6.8-7
- ≥ 6.1.0-8 · < 6.2.3-12
No data.
Red Hat OpenShift Container Platform 3.10
search-guard-kibana-plugin
Not affected
Red Hat OpenShift Container Platform 3.11
search-guard-kibana-plugin
Not affected
Red Hat OpenShift Container Platform 3.9
search-guard-kibana-plugin
Not affected
Red Hat OpenShift Container Platform 4
search-guard-kibana-plugin
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat OpenShift Container Platform 3.10 | search-guard-kibana-plugin | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | search-guard-kibana-plugin | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.9 | search-guard-kibana-plugin | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | search-guard-kibana-plugin | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (7)
- https://access.redhat.com/security/cve/CVE-2019-13423 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1747485 Issue Tracking
- https://docs.search-guard.com/6.x-25/changelog-kibana-6.x-12 x_refsource_CONFIRMVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4917 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-13423
- https://search-guard.com/cve-advisory/ x_refsource_MISCVendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-13423
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-13423 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1747485 | Issue Tracking | |
| https://docs.search-guard.com/6.x-25/changelog-kibana-6.x-12 | x_refsource_CONFIRMVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4917 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-13423 | ||
| https://search-guard.com/cve-advisory/ | x_refsource_MISCVendor Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2019-13423 |
Change history (0)
No recorded changes yet.