VULNERABILITY INTELLIGENCE

CVE-2020-7013

CVSS score7.2 HIGH
EPSS probability2.15%
CISA KEVNot currently listed
Published2020-06-03
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.

Weakness classification

  • security@elastic.co: CWE-94
  • nvd@nist.gov: CWE-94

Primary references