Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

An update of the kibana package has been released.

Nethanel Coppenhagen of CyberArk Labs discovered Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code.
This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202897	Photon OS 3.0: Kibana PHSA-2019-3.0-0002	Nessus	PhotonOS Local Security Checks	critical
133299	Photon OS 1.0: Kibana PHSA-2019-1.0-0209	Nessus	PhotonOS Local Security Checks	critical
122907	Photon OS 2.0: Kibana PHSA-2019-2.0-0132	Nessus	PhotonOS Local Security Checks	critical
118798	Kibana ESA-2018-18	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2018-17246

critical

Tenable Plugins

critical

critical

critical

critical