Code Injection in Kibana - CVE-2019-7610
Published: March 27, 2019
Vulnerability identifier: #VU18083
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-7610
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in the security audit logger, if the setting xpack.security.audit.enabled set to true. A remote attacker can send a specially crafted request and execute arbitrary javascript code on the target system with privileges of the Kibana process on the host system.
Affected software
Kibana
Arch Linux
Red Hat OpenShift Container Platform
Arch Linux
Red Hat OpenShift Container Platform
How to mitigate CVE-2019-7610
Install updates from vendor's website.
Kibana - addressed in versions 5.6.15, 6.6.1