Vulnerability Intelligence Report
CVE-2018-17245
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:1.29%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-201 ↗CWE-201: Information Exposure Through Sent Data
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Elastic | Kibana | 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
1.295%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Elastic · Vendor · Netherlands |
| Reserved | 2018-09-20T00:00:00 |
| Published | 2018-12-20T22:00:00 |
| Patch Date | 2018-12-20 |
| Last Updated | 2024-08-05T10:47:04 |
Community Chatter & Buzz