PT-2017-18335 · Elastic · Kibana X-Pack+1

Published 2017-06-30 · Updated 2020-10-19 · CVE-2017-8443

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kibana X-Pack security versions prior to 5.4.3

Description The issue allows an attacker to craft a Kibana URL that could redirect a user to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar, potentially exposing them to untrusted parties or logging them into the Kibana access logs.

Recommendations For versions prior to 5.4.3, update to version 5.4.3 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-598

Related Identifiers

CVE-2017-8443

Affected Products

Kibana

Kibana X-Pack

References · 4

• https://osv.dev/vulnerability/CVE-2017-8443 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8443 · Security Note
• https://elastic.co/community/security · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8443 · Note