Kibana versions prior to 4.1.3 and 4.2.1 suffer from a cross site request forgery vulnerability.