Code Injection in Kibana - CVE-2019-7609
Published: March 27, 2019 / Updated: June 21, 2024
Vulnerability identifier: #VU18085
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-7609
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in the Timelion visualizer. A remote attacker with access to the Timelion application can send a specially crafted request and execute arbitrary javascript code on the target system with privileges of the Kibana process on the host system.
Affected software
Kibana
Arch Linux
Red Hat OpenShift Container Platform
Arch Linux
Red Hat OpenShift Container Platform
How to mitigate CVE-2019-7609
Install updates from vendor's website.
Kibana - addressed in versions 5.6.15, 6.6.1