PT-2017-18335 · Elastic · Kibana X-Pack+1

Publicado 2017-06-30 · Atualizado 2020-10-19 · CVE-2017-8443

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kibana X-Pack security versions prior to 5.4.3

Description The issue allows an attacker to craft a Kibana URL that could redirect a user to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar, potentially exposing them to untrusted parties or logging them into the Kibana access logs.

Recommendations For versions prior to 5.4.3, update to version 5.4.3 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-598

Identificadores relacionados

CVE-2017-8443

Produtos afetados

Kibana

Kibana X-Pack

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-8443 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8443 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-8443 · Nota de Segurança
• https://elastic.co/community/security · Aviso do Fabricante