Published: 20/12/2018 Updated: 14/08/2020

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Kibana versions prior to 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

Vulnerable Product	Search on Vulmon	Subscribe to Product
elastic kibana
redhat openshift container platform 3.11

Kibana, before 643 and 5613, contain an arbitrary file inclusion flaw in the Console plugin An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript code This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system ...

CVE-2018-17246 - Kibana LFI < 6.4.3 & 5.6.13

CVE-2018-17246 - Kibana LFI < 643 & 5613 A Local File Inclusion on Kibana found by CyberArk Labs, the LFI can be use to execute a reverse shell on the Kibana server with the following payload: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=//////////path/to/shelljs As you alread

HTB_Ippsec_Note HayStack Machine - 101010115 nmap -sC -sV -oA nmap/haystack 101010115 Navigate to 101010115 --> Simple Photo Lets check robotstxt Navigate to 101010115/robotstxt --> 404 not Found Save the image and run tools like exiftool etc root@kali: exiftool ~/Downloads/needlejpg --> File Modification Date --Today Sometimes Downloading f

ElasticSearch exploit and Pentesting guide for penetration tester

ElasticSearch Pentesting ElasticSearch exploit and Pentesting guide for penetration tester What is an Elasticsearch index? An Elasticsearch index is a collection of documents that are related to each other Elasticsearch stores data as JSON documents Brute Force Credentials hydra -L usernamestxt -P passwordstxt <target-ip> -s 9200 http-get /

FoodCyberSec <3

We ❤️ FoodCyberSec 1 Dev Machine SQL Injection Broken Authentication Session Management Broken Access Control Fail Authorization System Security Misconfiguration PHP allows dangerous function 2 Cry Cry Cry Samba EternalBlue on Linux Broken Access Control 3 Query1 SQL Injection parameter is not validated Security Misconfiguration Unchecked uploaded f

CWE-829 https://www.elastic.co/community/security https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594 http://www.securityfocus.com/bid/106285 https://access.redhat.com/errata/RHBA-2018:3743 https://nvd.nist.gov https://github.com/mpgn/CVE-2018-17246 https://access.redhat.com/security/cve/cve-2018-17246

CVE-2018-17246

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect