CVE-2018-17245
20.12.2018, 22:29
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.Enginsight
| Vendor | Product | Version |
|---|---|---|
| elastic | kibana | 4.0.0 ≤ 𝑥 ≤ 4.6.0 |
| elastic | kibana | 5.0.0 ≤ 𝑥 ≤ 5.6.12 |
| elastic | kibana | 6.0.0 ≤ 𝑥 ≤ 6.4.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-201 - Insertion of Sensitive Information Into Sent DataThe code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
- CWE-522 - Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.