Critical severity9.8NVD Advisory· Published Dec 20, 2018· Updated Jun 17, 2026

CVE-2018-17246

Description

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Elastic/Kibana3 versions
cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*range: >=5.0.0,<5.6.13
- (no CPE)range: <6.4.3, <5.6.13
- (no CPE)range: before 6.4.3 and 5.6.13
Red Hat/Openshift Container Platform
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/106285nvdThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHBA-2018:3743nvdThird Party Advisory
discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594nvdVendor Advisory
www.elastic.co/community/securitynvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.066
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000