Open Redirect Affecting github.com/openshift/elasticsearch-operator Open this link in a new tab package, versions *
Attack Complexity
High
User Interaction
Required
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-GOLANG-GITHUBCOMOPENSHIFTELASTICSEARCHOPERATOR-1047886
-
published
2 Dec 2020
-
disclosed
2 Dec 2020
-
credit
Aivaras Laimikis
Introduced: 2 Dec 2020
CVE-2020-27816 Open this link in a new tabHow to fix?
A fix was pushed into the master
branch but not yet published.
Overview
github.com/openshift/elasticsearch-operator is an Elasticsearch operator to run Elasticsearch cluster on top of Openshift and Kubernetes.
Affected versions of this package are vulnerable to Open Redirect. It does not validate the namespace where kibana logging resource is created. This makes it possible to replace the original openshift-logging console link to different one which can lead to an arbitrary URL redirection.