CVE-2016-10364
Severity Score
6.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions.
Con X-Pack instalado, Kibana en sus versiones 5.0.0 y 5.0.1 no autentifica debidamente las solicitudes a las configuraciones avanzadas y el servicio de URLs cortas, cualquier usuario autentificado podría realizar una solicitud a estos servicios sin considerar sus propios permisos.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-05-02 CVE Reserved
- 2017-06-16 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
- CWE-306: Missing Authentication for Critical Function
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.elastic.co/community/security | 2020-08-14 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Elastic Search vendor "Elastic" | Kibana Search vendor "Elastic" for product "Kibana" | 5.0.0 Search vendor "Elastic" for product "Kibana" and version "5.0.0" | - |
Affected
| ||||||
| Elastic Search vendor "Elastic" | Kibana Search vendor "Elastic" for product "Kibana" | 5.0.1 Search vendor "Elastic" for product "Kibana" and version "5.0.1" | - |
Affected
| ||||||