VULNERABILITY INTELLIGENCE

CVE-2019-7610

CVSS score9 CRITICAL
EPSS probability3.89%
CISA KEVNot currently listed
Published2019-03-25
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

Weakness classification

  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references