CVE-2020-27816

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-02 · updated 2026-06-17
Weakness: CWE-601

Description

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7.

Affected products

Kibana: through 4.7
Red Hat OpenShift Container Platform 4.18: 4.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=1902698
https://bugzilla.redhat.com/show_bug.cgi?id=1902698

Get alerted when CVE-2020-27816 or the next vulnerability affects your stack