CVE-2020-10743 Cross-site request forgery in Kibana

What is CVE-2020-10743?

CVE-2020-10743 is a medium-severity vulnerability in Elastic Kibana, published on 2 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests. This flaw allows an attacker to trick a user into performing arbitrary actions in OCP's distribution of Kibana, such as clickjacking.

Weakness: CWE-1021, CWE-358

Which versions are affected by CVE-2020-10743?

It affects 2 products.

Products include Elastic Kibana, Redhat Openshift Container Platform.

How do I fix CVE-2020-10743?

Apply the vendor's patch.

Is CVE-2020-10743 being exploited?

There is no known exploitation of CVE-2020-10743 in the wild and no public exploit code.

Other vulnerabilities in Elastic Kibana

• CVE-2019-7609 Kibana Arbitrary Code Execution Exploited Critical 9.8
• CVE-2025-25015 Kibana arbitrary code execution via prototype pollution Critical 9.9
• CVE-2024-37288 Deserialization in Kibana Critical 9.9
• CVE-2023-31415 Code injection in Kibana Critical 9.9
• CVE-2018-17245 Information disclosure in Kibana Critical 9.8

All Elastic Kibana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5h6f-94qc-p3v7, MINI-2frp-g33p-xw24, MINI-5m7p-mj9v-6cf5, MINI-fpxf-xgpc-f3cg, MINI-hm7w-79m8-xg5c, MINI-q6r9-9q3c-xf32 and 3 more.