CVE-2018-17246

2018-12-2022:00:00

CWE-73

elastic

www.cve.org

AI Score

9.6

Confidence

High

EPSS

0.963

Percentile

99.6%

JSON

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

CNA Affected

[
  {
    "product": "Kibana",
    "vendor": "Elastic",
    "versions": [
      {
        "status": "affected",
        "version": "before 6.4.3 and 5.6.13"
      }
    ]
  }
]