Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.
References
| Link | Resource |
|---|---|
| https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330 | Vendor Advisory |
| https://www.elastic.co/community/security/ | Vendor Advisory |
| https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330 | Vendor Advisory |
| https://www.elastic.co/community/security/ | Vendor Advisory |
Configurations
History
21 Nov 2024, 08:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330 - Vendor Advisory | |
| References | () https://www.elastic.co/community/security/ - Vendor Advisory |
Information
Published : 2023-05-04 21:15
Updated : 2024-11-21 08:01
NVD link : CVE-2023-31415
Mitre link : CVE-2023-31415
CVE.ORG link : CVE-2023-31415
JSON object : View
Products Affected
elastic
- kibana
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')