CVE-2018-17245
published 2018-12-20CVE-2018-17245: Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a…
PriorityP349critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
1.29%
66.7th percentile
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | — | — |
| elastic | kibana | 4.0.0 – 4.6.0 | — |
| elastic | kibana | 5.0.0 – 5.6.12 | — |
| elastic | kibana | 6.0.0 – 6.4.2 | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j8h5-wqfr-cxp3: Kibana versions 4
ghsa_unreviewed·2022-05-13
CVE-2018-17245 [CRITICAL] CWE-522 GHSA-j8h5-wqfr-cxp3: Kibana versions 4
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.
Red Hat
kibana: Information leak in the PDF generation process
vendor_redhat·2018-11-06·CVSS 9.8
CVE-2018-17245 [CRITICAL] CWE-201 kibana: Information leak in the PDF generation process
kibana: Information leak in the PDF generation process
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.
Package: kibana (Red Hat OpenShift Container Platform 3.10) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.11) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.2) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.3) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.4) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.5) -
No detection rules found.
No public exploits indexed.
2018-12-20
Published