CVE-2016-1000218

Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate superfluous reports whenever an authenticated Kibana user navigates to a specially-crafted page.

• CWE-352

• http://www.securityfocus.com/bid/99253Third Party Advisory, VDB Entry
• https://www.elastic.co/community/securityVendor Advisory
• http://www.securityfocus.com/bid/99253Third Party Advisory, VDB Entry
• https://www.elastic.co/community/securityVendor Advisory

Published

Jun 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10002Incorrect processing of responses to If-None-Modified HTTP c…
• CVE-2016-1000213Ruckus Wireless H500 web management interface CSRF
• CVE-2016-1000214Ruckus Wireless H500 web management interface authentication…
• CVE-2016-1000215Ruckus Wireless H500 web management interface denial of serv…
• CVE-2016-1000216Ruckus Wireless H500 web management interface authenticated …
• CVE-2016-1000217Zotpress plugin for WordPress SQLi in zp_get_account()
• CVE-2016-1000219Kibana before 4.5.4 and 4.1.11 when a custom output is confi…
• CVE-2016-1000220Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS atta…
• CVE-2016-1000221Logstash prior to version 2.3.4, Elasticsearch Output plugin…
• CVE-2016-1000222Logstash prior to version 2.1.2, the CSV output can be attac…
• CVE-2016-1000229swagger-ui has XSS in key names6.1
• CVE-2016-1000232NodeJS Tough-Cookie version 2.2.2 contains a Regular Express…