CVE-2019-13423 - CVE House
Back to Database
Status published High CVE-2019-13423

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12...

Vulnerability Description

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong credentials when all of the following conditions a-c are true: a) Kibana is configured to use Single-Sign-On as authentication method, one of Kerberos, JWT, Proxy, Client certificate. b) The kibanaserver user is configured to use HTTP Basic as the authentication method. c) Search Guard is configured to use an SSO authentication domain and HTTP Basic at the same time

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-13423

Credits & Attribution

No credits recorded in the NVD database.

References

More from floragunn

View All →
CVE-2025-13653
Unauthorized access to documents in data streams with specially crafted requests
Medium 4.3
CVE-2025-12149
Unauthorized access to documents protected by Document-Level Security (DLS), when Signals watches include a search query involving protected documents
Medium 6
CVE-2025-12148
Unauthorized access to fields protected by Field Masking (FM) for fields of type IP
Medium 6
CVE-2025-12147
Unauthorized access to fields protected by Field-Level Security (FLS) when those fields are members of an object
Medium 6
CVE-2019-13422
Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12...
Medium 6.1

Affected Vendor

Affected Software

Search Guard Kibana Plugin
Vulnerable Versions:
unspecified

Timeline

Official Publish: August 23rd, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access