Servers and applications
CVE-2016-1000219
Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.
- Severity
- High 7.5
- Published
- 16 Jun 2017
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 4.1.11, 4.5.4
- Exploit chance
- 2% in the next 30 daysHigher than 81% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- Improper authorization (CWE-285)
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Change data
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
KibanaServers and applications · cpe:a:elastic:kibana |
|