Homepage About Snyk

Open Redirect Affecting github.com/openshift/elasticsearch-operator package, versions *

0.0
low

  • Attack Complexity

    High

  • User Interaction

    Required

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-GOLANG-GITHUBCOMOPENSHIFTELASTICSEARCHOPERATOR-1047886

  • published

    2 Dec 2020

  • disclosed

    2 Dec 2020

  • credit

    Aivaras Laimikis

Report a new vulnerability Found a mistake?

Introduced: 2 Dec 2020

CVE-2020-27816 Open this link in a new tab
CWE-601 Open this link in a new tab

How to fix?

A fix was pushed into the master branch but not yet published.

Overview

github.com/openshift/elasticsearch-operator is an Elasticsearch operator to run Elasticsearch cluster on top of Openshift and Kubernetes.

Affected versions of this package are vulnerable to Open Redirect. It does not validate the namespace where kibana logging resource is created. This makes it possible to replace the original openshift-logging console link to different one which can lead to an arbitrary URL redirection.