CVE-2020-7013

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-7013
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7013.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-7013
Published
2020-06-03T18:15:22.963Z
Modified
2026-04-10T04:28:00.121692Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.

References

Affected packages

Git / github.com/elastic/kibana

Affected ranges

Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f287f702223d72e963bf7ea663b89868fec88e11
Introduced
ee89fda8a17eff9c93f7400c102edf76cb4d7d8a
Fixed
e13d5b1fed429df03e29af259ffccd6453250947
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
edfd7e6e2b18a73b48d5126084e0454919f30e9f
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.8.9"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.7.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0"
        }
    ]
}

Affected versions

7.*
7.0-known-good
v4.*
v4.0.0
v4.0.0-beta1
v4.0.0-beta1.1
v4.0.0-beta2
v4.0.0-beta3
v4.2.0-beta1
v5.*
v5.0.0-alpha5
v6.*
v6.0.0-alpha1
v6.0.0-alpha2
v6.7.0
v6.7.1
v6.7.2
v6.8.0
v6.8.1
v6.8.2
v6.8.3
v6.8.4
v6.8.5
v6.8.6
v6.8.7
v6.8.8
v7.*
v7.0.0-alpha1
v7.0.0-alpha2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7013.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.11"
            }
        ]
    }
]