Insecure Credential Handling in Kibana PDF Report Generation

CVE-2018-17245 · MEDIUM Severity

AV:N/AC:L/AU:N/C:P/I:N/A:N

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.

Learn more about our External Network Penetration Testing.