VULNERABILITY INTELLIGENCE

CVE-2020-7016

CVSS score4.8 MEDIUM

EPSS probability1.08%

CISA KEVNot currently listed

Published2020-07-27

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Description

Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user can lead to the Kibana process consuming large amounts of CPU and becoming unresponsive.

Weakness classification

CWE-185: Incorrect Regular Expression
CWE-400: Uncontrolled Resource Consumption

Primary references

security@elastic.co — Release Notes, Vendor Advisory
security@elastic.co — Vendor Advisory
security@elastic.co — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory