{"id":"CVE-2021-22141","aliases":["EUVD-2021-9292","GHSA-whx6-754g-3x5v","SUSE-SU-2021:3729-1","SUSE-SU-2022:1654-1"],"status":"published","title":"An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user...","description":"An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00594,"percentile":0.48713,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-601"],"published":"2021-11-19T12:39:54Z","modified":"2026-10-24T14:24:43Z","affected":[{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1628097238.f6cbb0e-3.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1627995376.30bdf85-3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-4.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-4.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev23-3.31.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-ec2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1~dev6-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev4-3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1628179051.7d761bff-3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev5-3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev7-3.25.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev19-3.28.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev91-3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-8.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev23-3.28.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.1~dev30-3.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-4.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev17-4.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev7-3.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev60-3.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1~dev10-3.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2~dev3-3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev164-6.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev91-3.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.2~dev48-2.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+git.1630614261.26948f746-3.37.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-4.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-4.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev23-3.31.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-ec2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1~dev6-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev4-3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1628179051.7d761bff-3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev5-3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev7-3.25.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev19-3.28.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev91-3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-8.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.0-4.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-redcarpet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-4.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-installation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-operations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-opsconsole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-planning","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-5.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-keystone-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-5.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-monasca-notification","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2~dev4-3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-11.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2~dev1-11.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-installation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-operations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-opsconsole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-planning","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-supplement","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-upstream-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-upstream-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-5.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-keystone-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-5.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-monasca-notification","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2~dev4-3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-11.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2~dev1-11.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-supplement","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-upstream-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-upstream-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20211112-1.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-5.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-keystone-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-5.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-monasca-notification","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2~dev4-3.9.1"}]}],"bundled":2}],"products":[{"vendor":"elastic","product":"kibana"}],"references":[{"url":"https://www.elastic.co/community/security/","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22141"},{"url":"https://www.elastic.co/community/security"},{"url":"https://github.com/advisories/GHSA-whx6-754g-3x5v"},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213729-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180837","tags":["report"]},{"url":"https://bugzilla.suse.com/1185836","tags":["report"]},{"url":"https://bugzilla.suse.com/1186868","tags":["report"]},{"url":"https://bugzilla.suse.com/1189052","tags":["report"]},{"url":"https://bugzilla.suse.com/1191681","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41136","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221654-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189390","tags":["report"]},{"url":"https://bugzilla.suse.com/1197204","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38155","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-22141","description":"An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.","status":"published","published":"2022-11-18T00:00:00Z","modified":"2025-04-29T19:36:13.142Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:32:57.701381Z"}],"euvd":[{"id":"EUVD-2021-9292","description":"An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.","status":"published","published":"2022-11-18T00:00:00Z","modified":"2025-04-29T19:36:13Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:00.012701Z"}],"ghsa":[{"id":"GHSA-whx6-754g-3x5v","title":"An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user...","description":"An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.","status":"published","published":"2022-11-19T00:30:55Z","modified":"2025-04-29T21:32:28Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:02:04.142676Z"}],"nvd":[{"id":"CVE-2021-22141","description":"An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.","status":"published","published":"2022-11-18T23:15:11.553Z","modified":"2026-06-17T03:36:41.287Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"CVE-2021-22141","description":"An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.","status":"published","published":"2022-11-18T23:15:11.553Z","modified":"2026-10-24T14:24:43.92930533Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"SUSE-SU-2021:3729-1","title":"Security update for ardana-ansible, ardana-monasca, crowbar-openstack, influxdb, kibana, openstack-cinder, openstack-ec2-api, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-keystone, openstack-neutron-gbp, openstack-nova, python-eventlet, rubygem-redcarpet, rubygem-puma","description":"This update for ardana-ansible, ardana-monasca, crowbar-openstack, influxdb, kibana, openstack-cinder, openstack-ec2-api, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-keystone, openstack-neutron-gbp, openstack-nova, python-eventlet, rubygem-redcarpet, rubygem-puma contains the following fixes:\n\nSecurity fixes included in this update:\n\nkibana:\nCVE-2021-22141: Fixed URL redirection flaw (bsc#1186868).\n\npython-eventlet:\nCVE-2021-21419: Fixed improper handling of highly compressed data and memory allocation with excessive size value. (bsc#1185836)\n\nrubygem-redcarpet:\nCVE-2020-26298: Fixed XSS via HTML escaping when processing quotes. (bsc#1180837)\n\nrubygem-puma:\nCVE-2021-41136: Fixes build of the Java state machine for parsing HTTP. (bsc#1191681)\n\nNon-security fixes included in this update:\n\nChanges in ardana-ansible:\n  * Patch service.py to skip blank lines.\n\nChanges in ardana-monasca:\n  * Use specific TLS versions for monasca-thresh DB connections. (SOC-11543)\n\nChanges in crowbar-openstack:\n  * keystone wakeup: get new session on any error. (bsc#1189052)\n\nChanges in influxdb:\n- Set GO111MODULE=auto to fix build with go1.16 and later where default is GO111MODULE=on\n\nCanges in kibana:\n  - Fix an open redirect flaw. (CVE-2021-22141, bsc#1186868)\n\nChanges in openstack-cinder:\n  * Fix typo in Dell EMC Unity driver documentation.\n  * Drop lower-constraints job.\n  * [stable-only] Cap bandit to v1.6.2 and fix constraints.\n\nChanges in openstack-ec2-api:\n  * Remove jobs corresponds to obselete featuresets.\n  * OpenDev Migration Patch.\n\nChanges in openstack-heat-gbp:\n  * Add support for Wallaby.\n  * Fix upstream gate.\n\nChanges in openstack-heat-templates:\n  * [ussuri][goal] Update contributor documentation.\n  * Fix zuul config for heat-templates-check.\n  * Remove testr.\n\nChanges in openstack-horizon-plugin-gbp-ui:\n  * Add support for Wallaby.\n  * Fix upstream gate.\n\nChanges in openstack-keystone:\n  * Retry update\\_user when sqlalchemy raises StaleDataErrors.\n  * Pin keystone-tempest-plugin for py27 compatibility.\n\nChanges in openstack-neutron-gbp:\n  * Fix update router API.\n  * Fix HA IP DB migration.\n  * Revert 'Fix HA IP DB migration'.\n  * Fix HA IP DB migration.\n  * Add network\\_id column to apic\\_ml2\\_ha\\_ipaddress\\_to\\_port\\_owner table.\n  * Use custom converter for extra attributes.\n  * Validate network before creating or updating router.\n  * Fix Data Migration query for HA IP table.\n  * System security grp:Add system sg in port sg list.\n  * Add vrf column to apic\\_ml2\\_ha\\_ipaddress\\_to\\_port\\_owner table.\n  * [apic\\_aim]: Fix HA IP UTs.\n  * Fixing the exception msg for IPAddressGenerationFailure.\n  * Enhancement regarding router/instance attachment to an external network floating ip and snat subnets.\n  * Setting legacy-group-based-policy-dsvm-aim to non-voting gate.\n  * Add support for Wallaby.\n  * Bug fixes for gbp-validate.\n  * [apic\\_aim]: Filter endpoint details.\n  * Bugfix: Policy Enforcement Pref.\n  * Fix unit-tests for tenant-scope validation.\n  * [AIM] Add Policy Enforcement Pref to network extension.\n\nChanges in openstack-nova:\n  * [neutron] Get only ID and name of the SGs from Neutron.\n  * Remove allocations before setting vm\\_status to SHELVED\\_OFFLOADED.\n  * libvirt:driver:Disallow AIO=native when 'O\\_DIRECT' is not available.\n  * Update pci stat pools based on PCI device changes.\n  * Use subqueryload() instead of joinedload() for (system\\_)metadata.\n\nChanges in python-eventlet:\n  Websocket: Limit maximum uncompressed frame length to 8MiB. (bsc#1185836 CVE-2021-21419)\n  ","status":"published","published":"2021-11-19T12:39:54Z","modified":"2026-02-04T04:40:14.481672Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2022:1654-1","title":"Security update for documentation-suse-openstack-cloud, kibana, openstack-keystone, openstack-monasca-notification","description":"This update for documentation-suse-openstack-cloud, kibana, openstack-keystone, openstack-monasca-notification fixes the following issues:\n\n- CVE-2021-22141: Fixed URL redirection flaw (bsc#1186868).\n- CVE-2021-38155: Fixed information disclosure during account locking (bsc#1189390).\n\nThe following non-security bugs were fixed:\n\n- Fix smtp server authentication (bsc#1197204)\n","status":"published","published":"2022-05-12T15:16:00Z","modified":"2026-02-04T03:03:55.104552Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}