CVE-2023-31414

Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.

• CWE-94
• CWE-94

• https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330Vendor Advisory
• https://www.elastic.co/community/security/Vendor Advisory
• https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330Vendor Advisory
• https://www.elastic.co/community/security/Vendor Advisory

Published

May 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31409Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENS…7.5
• CVE-2023-3141A use-after-free flaw was found in r592_remove in drivers/me…7.1
• CVE-2023-31410A remote unprivileged attacker can intercept the communicati…7.4
• CVE-2023-31411A remote unprivileged attacker can modify and access configu…9.8
• CVE-2023-31412The LMS5xx uses weak hash generation methods, resulting in t…7.5
• CVE-2023-31413Filebeat versions through 7.17.9 and 8.6.2 have a flaw in ht…3.3
• CVE-2023-31415Kibana version 8.7.0 contains an arbitrary code execution fl…8.8
• CVE-2023-31416Secret token configuration is never applied when using ECK <…5.3
• CVE-2023-31417Elasticsearch generally filters out sensitive information an…4.4
• CVE-2023-31418An issue has been identified with how Elasticsearch handled …7.5
• CVE-2023-31419A flaw was discovered in Elasticsearch, affecting the _searc…7.5
• CVE-2023-3142Cross-site Scripting (XSS) - Stored in GitHub repository mic…5.4