CVE-2019-7610: Command Injection
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
References:
https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077
Other sources
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this security flaw?
The vulnerability ID for this security flaw is CVE-2019-7610.
What is the severity level of CVE-2019-7610?
CVE-2019-7610 has a severity level of critical.
Which software versions are affected by CVE-2019-7610?
Kibana versions before 6.6.1 and 5.6.15 are affected by CVE-2019-7610.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by sending a request that attempts to execute JavaScript code.
Are there any remedies available for CVE-2019-7610?
Yes, the remedy for CVE-2019-7610 is to update to Kibana version 6.6.1 or 5.6.15.