Elastic · Kibana · CVE-2018-17246
**Name of the Vulnerable Software and Affected Versions**
Kibana versions prior to 6.4.3
Kibana versions prior to 5.6.13
**Description**
The issue is related to an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request to execute javascript code, potentially leading to the execution of arbitrary commands with the permissions of the Kibana process on the host system.
**Recommendations**
For versions prior to 6.4.3, update to version 6.4.3 or later.
For versions prior to 5.6.13, update to version 5.6.13 or later.