CVE-2020-27816 | BDVDB-2026-145341 Detail

Description#

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12020-12-02Record published in the CVE List.
2. Version 22024-08-04Most recent update recorded in the CVE List.