CVE-2020-7012 — Code Injection in Kibana

CWE-94 — Code Injection5 documents5 sources
Severity
8.8HIGHNVD
EPSS
73.4%
top 1.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Kibana
Timeline
PublishedJun 3
Latest updateMay 24

Description

Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDelastic/kibana6.7.0 — 6.8.8+1
▶CVEListV5elastic/kibana6.7.0 to 6.8.8 and 7.0.0 to 7.6.2

🔴Vulnerability Details

2
GHSA
GHSA-xrx6-ghw2-jgjm: Kibana versions 6↗2022-05-24
▶
CVEList
CVE-2020-7012: Kibana versions 6↗2020-06-03
▶

📋Vendor Advisories

1
Red Hat
kibana: Prototype pollution in the Upgrade Assistant could result in arbitrary code execution (ESA-2020-05)↗2020-06-03
▶

💬Community

1
Bugzilla
CVE-2020-7012 kibana: Prototype pollution in the Upgrade Assistant could result in arbitrary code execution (ESA-2020-05)↗2020-06-19
▶
CVE-2020-7012 — Code Injection in Elastic Kibana | cvebase