Lucene search

RedhatCVE-2020-10743

HistoryJun 02, 2021 - 11:15 a.m.

CVE-2020-10743

2021-06-0211:15:07

CWE-358

CWE-1021

redhat

web.nvd.nist.gov

300

openshift

container platform

kibana

clickjacking

cve-2020-10743

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

33.8%

JSON

It was discovered that OpenShift Container Platform’s (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests. This flaw allows an attacker to trick a user into performing arbitrary actions in OCP’s distribution of Kibana, such as clickjacking.

Affected configurations

Nvd

Vulners

Node

elastickibanaMatch-

Node

redhatopenshift_container_platformMatch3.11.286

redhatopenshift_container_platformMatch4.6.1

VendorProductVersionCPE
elastickibana-cpe:2.3:a:elastic:kibana:-:*:*:*:*:*:*:*
redhatopenshift_container_platform3.11.286cpe:2.3:a:redhat:openshift_container_platform:3.11.286:*:*:*:*:*:*:*
redhatopenshift_container_platform4.6.1cpe:2.3:a:redhat:openshift_container_platform:4.6.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
elastic	kibana	-	cpe:2.3:a:elastic:kibana:-:::::::*
redhat	openshift_container_platform	3.11.286	cpe:2.3:a:redhat:openshift_container_platform:3.11.286:::::::*
redhat	openshift_container_platform	4.6.1	cpe:2.3:a:redhat:openshift_container_platform:4.6.1:::::::*

CNA Affected

[
  {
    "product": "Kibana",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "OpenShift Container Platform 3.11.286 and OpenShift Container Platform 4.6.1"
      }
    ]
  }
]

References

bugzilla.redhat.com/show_bug.cgi?id=1834550

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

33.8%

JSON

Related for CVE-2020-10743