CVE-2021-22141: 
Kibana vulnerability analysis and mitigation

An open redirect vulnerability (CVE-2021-22141) was discovered in Kibana versions before 7.13.0 and 6.8.16. The vulnerability was disclosed on May 25, 2021, affecting all versions of Kibana prior to the mentioned versions. This security flaw allows an attacker to redirect users to arbitrary websites if they visit a maliciously crafted URL while logged into Kibana (Elastic Advisory, NVD).

The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect'). It received a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required (NVD).

If successfully exploited, the vulnerability could result in Kibana redirecting a logged-in user to an arbitrary website. This could potentially be used in phishing attacks or other malicious redirect scenarios (Elastic Advisory).

The vulnerability requires user interaction, specifically requiring a logged-in user to visit a maliciously crafted URL. The attack vector is network-accessible, and no special privileges are required to execute the attack (NVD).

Users should update their version of Kibana to version 7.13.0 or 6.8.16 to address this vulnerability. No alternative workarounds were provided in the advisory (Elastic Advisory).