Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
NØX Echo Lineage Signal: CVE-2018-17246 Entity: Kibana Lineage: Public vulnerability → Public exploit/PoC → Observed exploitation Relationship: - Kibana → CVE-2018-17246 → Evidence → Operational Risk Current State: DISCLOSED, POC_AVAILABLE, ACTIVE_EXPLOITATION
NØØT Security Alerts Classification: Critical CVE: CVE-2018-17246 Product: Elastic / Kibana Summary: VulnCheck reports real-world exploitation activity affecting Elastic / Kibana. Evidence: Public PoC/exploit available; Active exploitation reported; Live exploitation observed by VulnCheck canaries Impact: The vulnerability can materially affect exposed systems; verify vendor-specific impact and affected versions. Action: Prioritize vendor remediation, identify exposed affected systems, and investigate for evidence of exploitation when applicable. Date: 13 Nov 2023 Source: https://vulncheck.com/xdb/f0ce7d6eae1d #NØØT #CyberSecurity #InfoSec #ThreatIntelligence #CyberThreats #CVE #CyberDefense #Kibana #CVE_2018_17246 #ActiveExploitation #Exploit
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | elastic | kibana | - | - | - |
| App | redhat | openshift_container_platform | 3.11 | - | - |