QwikSec

Security Database

CVE

CWE

Training

CVE-2018-17246

Published: Dec 20, 2018

Modified: Aug 5, 2024

PUBLISHED

Description

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

Vendor	Product	Versions
Elastic	Kibana	affected `before 6.4.3 and 5.6.13`

Weaknesses (CWE)

References

vdb-entry

x_refsource_BID

https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594

x_refsource_MISC

vendor-advisory

x_refsource_REDHAT

https://www.elastic.co/community/security

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.