CVE-2017-8443CWE-598

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized…

published June 30, 2017

CVSS
—
EPSS
1%
Percentile
65.3
In the wild
Unconfirmed
What it is

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be viewed by untrusted parties or logged into the Kibana access logs.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01104 · 65.3th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2017-06-30T19:00Z
EPSS history
Timeline
  • 30 JUN 19:00Z
    In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized…
    cvelistv5