by Kastro
Paper/Archive/CVE-2023-31415

CVE-2023-31415

Elastic Kibana — Kibana version 8.7.0 contains an arbitrary code execution flaw.

EPSS 1.0%CVSS 9.9
critical.is priorityof 100
42
CVSS 9.9 (ADP)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 61.5.615 × 2012.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.

Affected

ProductAffectedFixed inSource
Kibanaversion 8.7.0–CNA

Scores by source

CISA ADP9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refelastic.co/community/securityrefdiscuss.elastic.co/t/kibana-8-7-1-security-updates/332330