Security readout for executives and security teams
Plain-English summary
Older Kibana versions let attackers create links that look like they belong to the Kibana domain but send users to another website. This is mainly a trust and phishing risk, not evidence of server takeover from the provided sources.
Executive priority
Treat this as a moderate-priority cleanup if legacy Kibana remains in use. It is most urgent for public-facing or broadly accessible Kibana deployments because the risk centers on user trust and phishing enablement.
Technical view
CVE-2016-10365 is a CWE-601 open redirect in Elastic Kibana before 4.6.3 and 5.0.1. A crafted Kibana-domain URL can redirect to an arbitrary external site. The source bundle provides no CVSS vector, exploit details, or evidence of active exploitation.
Likely exposure
Exposure is limited to organizations still running Kibana versions before 4.6.3 or 5.0.1, especially where Kibana is reachable by users or externally accessible.
Exploitation context
The provided sources support crafted-link abuse only. This could aid phishing or credential-harvesting campaigns by abusing trust in a legitimate Kibana domain. KEV is false, and no cited source reports active exploitation.
Researcher notes
Evidence is sparse: the bundle identifies affected versions, CWE-601, and redirect behavior, but provides no CVSS, endpoint detail, exploit status, or configuration nuance. Avoid assuming broader impact beyond arbitrary redirect capability.
Mitigation direction
- Upgrade Kibana to 4.6.3, 5.0.1, or a later supported release.
- Review Elastic security guidance for any version-specific notes.
- Restrict Kibana exposure to trusted networks and authenticated users.
- Monitor for suspicious Kibana links that redirect to unfamiliar domains.
Validation and detection
- Inventory all Kibana instances and record exact versions.
- Confirm no production instance runs before 4.6.3 or 5.0.1.
- Review access logs for unusual redirect patterns from Kibana URLs.
- Verify Kibana is not unnecessarily internet-exposed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-601: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2016-10365 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.elastic.co/community/securityCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
URL Redirection to Untrusted Site ('Open Redirect')
URL Redirection to Untrusted Site ('Open Redirect') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.