CVE-2019-7609

critical

Description

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

From the Tenable Blog

CVE-2019-7609: Exploit Script Available for Kibana Remote Code Execution Vulnerability

Published: 2019-10-22

An exploit script for the previously patched Kibana vulnerability is now available on GitHub. Background On October 21, an exploit script was published to GitHub for a patched vulnerability in Kibana, the open-source data visualization plugin for Elasticsearch. Elasticsearch and Kibana are part of the popular Elastic Stack (also known as ELK Stack), a series of open-source applications used for centralized log management.