CVSS: 9.8EPSS: 95%CPEs: 3EXPL: 1CVE-2018-17246
https://notcve.org/view.php?id=CVE-2018-17246
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. Kibana, en versiones anteriores a la 6.4.3 y la 5.6.13, contiene un error de inclusión de archivos arbitrarios en el plugin Console. Un atacante con acceso a la API de la consola de Kibana podría enviar una petición que intentará ejecutar código JavaScript. • https://github.com/mpgn/CVE-2018-17246 http://www.securityfocus.com/bid/106285 https://access.redhat.com/errata/RHBA-2018:3743 https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594 https://www.elastic.co/community/security • CWE-73: External Control of File Name or Path CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 8.0EPSS: 0%CPEs: 2EXPL: 0CVE-2018-3830 – kibana: Cross-site scripting via the source field formatter
https://notcve.org/view.php?id=CVE-2018-3830
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Las versiones 5.3.0 a 6.4.1 de Kibana presentaban una vulnerabilidad Cross-Site Scripting (XSS) a través del formateador de los campos de origen que podrían permitir a un atacante obtener información sensible o realizar acciones destructivas en nombre de otros usuarios de Kibana. • https://access.redhat.com/errata/RHSA-2018:3537 https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035 https://www.elastic.co/community/security https://access.redhat.com/security/cve/CVE-2018-3830 https://bugzilla.redhat.com/show_bug.cgi?id=1632450 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-3818
https://notcve.org/view.php?id=CVE-2018-3818
Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Las versiones 5.1.1 a 6.1.2 y 5.6.6 de Kibana presentan una vulnerabilidad Cross-Site Scripting (XSS) a través del formateador de los campos de color que podrían permitir a un atacante obtener información sensible o realizar acciones destructivas en nombre de otros usuarios de Kibana. • http://www.securityfocus.com/bid/102734 https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-3821
https://notcve.org/view.php?id=CVE-2018-3821
Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Las versiones posteriores a la 5.1.1 y anteriores a la 5.6.7 y 6.1.3 de Kibana presentan una vulnerabilidad Cross-Site Scripting (XSS) en la visualización de la nube de etiquetas que podrían permitir a un atacante obtener información sensible o realizar acciones destructivas en nombre de otros usuarios de Kibana. • https://discuss.elastic.co/t/elastic-stack-6-1-3-and-5-6-7-security-update/117683 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-3819
https://notcve.org/view.php?id=CVE-2018-3819
The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website. La solución en Kibana para ESA-2017-23 era incompleta. Con la seguridad X-Pack habilitada, las versiones anteriores a la 6.1.2 y 5.6.7 de Kibana tienen una vulnerabilidad de redirección abierta en la página de inicio de sesión que permitiría que un atacante cree un enlace que redirija a una página web arbitraria. • https://discuss.elastic.co/t/elastic-stack-6-1-3-and-5-6-7-security-update/117683 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •