PT-2018-13965 · Elastic · Kibana

Nick Peihl + 1 · Published 2018-12-20 · Updated 2020-08-14 · CVE-2018-17245

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kibana versions 4.0 through 4.6 Kibana versions 5.0 through 5.6.12 Kibana versions 6.0 through 6.4.2

Description The issue concerns the way authorization credentials are used when generating PDF reports. If a report requests external resources, plaintext credentials are included in the HTTP request, which could be recovered by an external resource provider.

Recommendations For versions 4.0 through 4.6, update to a version outside of this range to resolve the issue. For versions 5.0 through 5.6.12, update to a version outside of this range to resolve the issue. For versions 6.0 through 6.4.2, update to a version outside of this range to resolve the issue.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-201

CWE-522

Related Identifiers

CVE-2018-17245

Affected Products

Kibana

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-17245 · Security Note
• https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-17245 · Vendor Advisory
• https://elastic.co/community/security · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17245 · Note