Vulnerabilities

CVSS

9.8 Critical

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk score

78.4

Published

2018-12-20

Status

Modified

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.

Weaknesses

CWE-201CWE-522

Coverage 1

threat-intel

Multiples vulnérabilités dans les produits Elastic (22 juillet 2026)

Multiple vulnerabilities have been discovered in Elastic products, including Elasticsearch and Kibana. These vulnerabilities can lead to data integrity compromise, data confidentiality breaches, and denial-of-service att…

CERT-FR · Jul 22, 2026 High

CVE-2018-17245CVE-2026-42397CVE-2026-49092vulnerabilityssrfelastic

All articles mentioning it

Advisories and references

• discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update...
• elastic.co/community/security
• discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update...
• elastic.co/community/security