by Kastro
Paper/Archive/CVE-2019-7609

CVE-2019-7609

Elastic Kibana — Kibana Arbitrary Code Execution

KEV · due 10 JulEPSS 95%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

Affected

ProductAffectedFixed inSource
Kibanabefore 5.6.15 and 6.6.1–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refdiscuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077refelastic.co/community/securityadvisoryaccess.redhat.com/errata/RHSA-2019:2860advisoryaccess.redhat.com/errata/RHBA-2019:2824refpacketstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7609kevcisa.gov/known-exploited-vulnerabilities-catalog