CVE-2019-7609: Kibana Arbitrary Code Execution
Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
Other sources
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kibanato a version that resolves this vulnerability.Fixed in 5.6.15 - Upgrade
Upgrade
redhat/kibanato a version that resolves this vulnerability.Fixed in 6.6.1
Event History
Frequently Asked Questions
What is CVE-2019-7609?
CVE-2019-7609 is a vulnerability that exists in Kibana versions before 5.6.15 and 6.6.1, allowing an attacker to execute arbitrary code.
Which applications are affected by CVE-2019-7609?
Kibana versions before 5.6.15 and 6.6.1 are affected by CVE-2019-7609.
What is the severity of CVE-2019-7609?
CVE-2019-7609 has a severity level of critical.
How can an attacker exploit CVE-2019-7609?
An attacker with access to the Timelion application in Kibana could send a request to execute JavaScript code.
How can I mitigate the vulnerability?
To mitigate the vulnerability, update your Kibana installation to version 5.6.15 or above for Kibana 5.x, or version 6.6.1 or above for Kibana 6.x.