CVE-2019-7609
Last modified
CVE-2019-7609 is a critical-severity vulnerability rated 10/10 on the CVSS scale. Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. CISA has confirmed active exploitation in the wild. EPSS estimates a 95.34% chance of exploitation in the next 30 days.
Description
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Kibana | < 5.6.15 |
| Elastic | Kibana | >= 6.0.0, < 6.6.1 |
| Redhat | Openshift Container Platform | 3.11 |
| Redhat | Openshift Container Platform | 4.1 |
References
- http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHBA-2019:2824Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2860Third Party Advisory
- https://www.elastic.co/community/securityBroken Link, Vendor Advisory
- http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHBA-2019:2824Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2860Third Party Advisory
- https://www.elastic.co/community/securityBroken Link, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7609US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2019-7609?
How severe is CVE-2019-7609?
How do I fix CVE-2019-7609?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-7588A vulnerability in the exacqVision Enterprise System Manager…6.7
- CVE-2019-7589A vulnerability with the SmartService API Service option exi…9.8
- CVE-2019-7590ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcps…6.7
- CVE-2019-7593Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.…6.8
- CVE-2019-7594Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.…6.8
- CVE-2019-7608Kibana versions before 5.6.15 and 6.6.1 had a cross-site scr…
- CVE-2019-7610Kibana versions before 6.6.1 contain an arbitrary code execu…
- CVE-2019-7611A permission issue was found in Elasticsearch versions befor…8.1
- CVE-2019-7612A sensitive data disclosure flaw was found in the way Logsta…9.8
- CVE-2019-7613Winlogbeat versions before 5.6.16 and 6.6.2 had an insuffici…7.5
- CVE-2019-7614A race condition flaw was found in the response headers Elas…5.9
- CVE-2019-7615A TLS certificate validation flaw was found in Elastic APM a…7.4
Are you affected by CVE-2019-7609?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST