CVE-2016-1000219

—

CVSS 3.0

7.5 high

EPSS

2%p80

Published

Jun 16, 2017 (Jun 16, 2017)

Modified

Jun 17, 2026

Description

Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.

Vendors: elastic
Products: kibana
Weakness: CWE-285
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (2.0%)

In the news0 stories

No ingested article mentions this CVE yet.