CVE-2017-8443: elastic kibana
Vulnerability summary
CVE-2017-8443 is a medium (CVSS 6.5) vulnerability in elastic kibana. EPSS estimates a 1.10% chance of exploitation in the next 30 days, higher than 65.4% of scored vulnerabilities.
Timeline
- 30-06-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be viewed by untrusted parties or logged into the Kibana access logs.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.10%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
+0.16 pp
From 0.94% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-598Use of HTTP Request With Sensitive Query StringThe web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Elastic2 products
- kibana≤ 5.4.2
- kibana x-pack security< 5.4.3
1 vendor · 2 products