Information disclosure in Elastic Kibana
CVE-2017-8443
In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be viewed by untrusted parties or logged into the Kibana access logs.
EPSS: 0.011 (62.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
Affected products
- Elastic Kibana
- Elastic Kibana X-pack Security — versions before 5.4.3
Weakness classification (CWE)
References
- security@elastic.co (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-8443?
- CVE-2017-8443 is a medium-severity vulnerability in Elastic Kibana, classified under CWE-598. CVSS score: 6.5/10. Published 2017-06-30.
- How severe is CVE-2017-8443?
- Medium severity. CVSS v3 base score is 6.5 out of 10.