CVE-2016-10364

Published: Jun 16, 2017Modified: May 13, 2026

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions.

Affected (2)

Products: Elastic: Kibana

Elastic

1 product

Kibana

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Elastic Kibana	Version 5.0.0
Elastic Kibana	Version 5.0.1

Related CWEs

CWE-264

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://www.elastic.co/community/security

Source: security@elastic.co

Vendor Advisory

https://www.elastic.co/community/security

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.