CVE-2019-7610 — Code Injection in Kibana

CWE-94 — Code InjectionCWE-77 — Command InjectionCWE-20 — Improper Input Validation5 documents5 sources
Severity
9.0CRITICALNVD
EPSS
1.1%
top 22.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Kibana
Timeline
PublishedMar 25
Latest updateMay 14

Description

Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 2.2 | Impact: 6.0

Affected Packages2 packages

▶NVDelastic/kibana6.0.0 — 6.6.1+1
▶CVEListV5elastic/kibanabefore 6.6.1

🔴Vulnerability Details

2
GHSA
GHSA-rrx3-4wcg-f297: Kibana versions before 6↗2022-05-14
▶
CVEList
CVE-2019-7610: Kibana versions before 6↗2019-03-25
▶

📋Vendor Advisories

1
Red Hat
kibana: Audit logging Remote Code Execution issue↗2019-02-19
▶

💬Community

1
Bugzilla
CVE-2019-7610 kibana: Audit logging Remote Code Execution issue↗2019-04-04
▶
CVE-2019-7610 — Code Injection in Elastic Kibana | cvebase