PT-2018-13965 · Elastic · Kibana

Nick Peihl + 1 · Publicado 2018-12-20 · Atualizado 2020-08-14 · CVE-2018-17245

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kibana versions 4.0 through 4.6 Kibana versions 5.0 through 5.6.12 Kibana versions 6.0 through 6.4.2

Description The issue concerns the way authorization credentials are used when generating PDF reports. If a report requests external resources, plaintext credentials are included in the HTTP request, which could be recovered by an external resource provider.

Recommendations For versions 4.0 through 4.6, update to a version outside of this range to resolve the issue. For versions 5.0 through 5.6.12, update to a version outside of this range to resolve the issue. For versions 6.0 through 6.4.2, update to a version outside of this range to resolve the issue.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-201

CWE-522

Identificadores relacionados

CVE-2018-17245

Produtos afetados

Kibana

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-17245 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17245 · Nota
• https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-17245 · Aviso do Fabricante
• https://elastic.co/community/security · Aviso do Fabricante