CVE-2017-8443
medium
CVSS v3
6.5
CVSS v2
4.3
VIR risk
6.5
Description
In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be viewed by untrusted parties or logged into the Kibana access logs.
Predictions
Exploit likelihood
75%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2017-8443.html
Vendor advisory: security@elastic.co — https://www.elastic.co/community/security
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| elastic | kibana | {"endIncluding":"5.4.2"} | |
References
CWEs
CWE-598 CWE-200
Verify integrity in audit chain (admin only). AS-IS.