CVE-2019-7609

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-7609
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-7609.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-7609
Downstream
Published
2019-03-25T19:29:02.147Z
Modified
2026-03-15T22:34:19.856851Z
Severity
  • 10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

References

Affected packages

Git / github.com/elastic/kibana

Affected ranges

Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e4f1e8f824c4cdc70bfa09a5ec734d7108366456
Introduced
f8bc449f5a6b28d0597730b1cf03fefe7e33422e
Fixed
c0c81857d435f499ec2514d9a4823e3dc87021bd
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2d248dc25916881521cad4844c2789af3187b065
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.6.15"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.6.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-7609.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.11"
            }
        ]
    }
]