CVE-2018-17245: Critical severity elastic vulnerability

Q: What is CVE-2018-17245?

CVE-2018-17245 is a vulnerability found in Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 that allows plaintext credentials to be included in HTTP requests when generating PDF reports.

Q: How severe is CVE-2018-17245?

CVE-2018-17245 has a severity score of 9.8, which is considered critical.

Q: How can I fix CVE-2018-17245?

To fix CVE-2018-17245, it is recommended to upgrade Kibana to a version that is not affected (6.4.3 or 5.6.13) or apply the security update provided by Elastic.

Q: What is the Common Weakness Enumeration (CWE) for CVE-2018-17245?

CVE-2018-17245 is associated with CWE-522 (Insufficiently Protected Credentials) and CWE-201 (Information Exposure).

Published Dec 20, 2018

Updated

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.

Affected Software

3 affected components

Elastic Kibana>=4.0.0<=4.6.0

Elastic Kibana>=5.0.0<=5.6.12

Elastic Kibana>=6.0.0<=6.4.2

Event History

Dec 20, 2018

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2018-17245?

CVE-2018-17245 is a vulnerability found in Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 that allows plaintext credentials to be included in HTTP requests when generating PDF reports.

How severe is CVE-2018-17245?

CVE-2018-17245 has a severity score of 9.8, which is considered critical.

Which software versions are affected by CVE-2018-17245?

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 are affected by CVE-2018-17245.

How can I fix CVE-2018-17245?