CVE-2018-17245 Information disclosure in Kibana

Critical 9.8 Published 20 Dec 2018 Updated 5 Aug 2024

Kibana leaks plaintext credentials to external resources during PDF report generation, allowing attackers to recover sensitive authentication data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-17245?

CVE-2018-17245 is a critical vulnerability in Elastic Kibana, published on 20 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.

Weakness: CWE-522, CWE-201

Which versions are affected by CVE-2018-17245?

It affects 1 product.

Products include Elastic Kibana.

How do I fix CVE-2018-17245?

No fix has been published for CVE-2018-17245 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-17245 being exploited?

There is no known exploitation of CVE-2018-17245 in the wild and no public exploit code.

All Elastic Kibana vulnerabilities

Sources

Also known as GHSA-j8h5-wqfr-cxp3.