CVE-2018-17245 — Sensitive Info Insertion into Sent Data in Kibana

CWE-201 — Sensitive Info Insertion into Sent Data CWE-522 — Insufficiently Protected Credentials5 documents5 sources

Severity

9.8CRITICALNVD

EPSS

0.3%

top 44.68%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Elastic Kibana

Timeline

PublishedDec 20

Latest updateMay 13

Description

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDelastic/kibana4.0.0 — 4.6.0+2

▶CVEListV5elastic/kibana4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2

🔴Vulnerability Details

GHSA

GHSA-j8h5-wqfr-cxp3: Kibana versions 4↗2022-05-13

▶

CVEList

CVE-2018-17245: Kibana versions 4↗2018-12-20

▶

📋Vendor Advisories

Red Hat

kibana: Information leak in the PDF generation process↗2018-11-06

▶

💬Community

Bugzilla

CVE-2018-17245 kibana: Information leak in the PDF generation process↗2018-11-07

▶