Detections
Analytics
CVE-2018-17246
critical
Description
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
References
https://github.com/Bhanunamikaze/VaktScan
https://github.com/PuddinCat/GithubRepoSpider
https://github.com/Almandev/Sub-folderFetcher
https://www.elastic.co/community/security
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-9005
https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594