Elastic Kibana
At a glance
- Source
- NVD
- EPSS
- EPSS 18.21 % · percentile 97 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- elastic
- NVD status
- Modified
Description
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.
Weaknesses (CWE)
- CWE-94 — Improper Control of Generation of Code
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-28150
- GCVE · GCVE-0-2020-7012
Affected configurations (NVD CPE)
cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 6.7.0 ≤ 6.8.8cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 7.0.0 ≤ 7.6.2
Affected products
| Product | Versions |
|---|---|
| Elastic · Kibana | affected 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |