CVE-2019-7609
100Vexday Risk Score
Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.
ssvc Actcvss 9.8epss 95%
de la publicación al arma207 días
Publicada en NVD25 mar
1ª PoC+207d
metasploit+219d
CISA KEV+1022d
probabilidad de explotación
95%top 1% de las CVE
explotación observada
síCISA + VulnCheck
26 exploit(s) público(s)
Acción exigida por CISAplazo federal: 2022-07-10
Apply updates per vendor instructions.
Investigado y redactado con IA a partir del advisory del fabricante y análisis públicos, con las fuentes citadas. Verifica siempre la versión corregida en el advisory oficial antes de actuar.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Elastic · KibanaPoCs públicas encontradas — 26
githubgithub.com/LandGrey/CVE-2019-7609★ 167githubgithub.com/jas502n/kibana-RCE★ 89githubgithub.com/mpgn/CVE-2019-7609★ 56githubgithub.com/hekadan/CVE-2019-7609★ 21githubgithub.com/Cr4ckC4t/cve-2019-7609★ 4githubgithub.com/rhbb/CVE-2019-7609★ 1githubgithub.com/dnr6419/CVE-2019-7609★ 1githubgithub.com/Akshay15-png/CVE-2019-7609★ 1githubgithub.com/wolf1892/CVE-2019-7609★ 0githubgithub.com/aleister1102/kibana-prototype-pollusion★ 0githubgithub.com/toxxxaka/CVE-2019-7609★ 0githubgithub.com/d0x-awrqxavc/CVE-2019-7609-KibanaRCE★ 0vulncheckvulncheck.com/xdb/e88fe8b26b66no verificadocve_referencepacketstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.htmlno verificadovulncheckvulncheck.com/xdb/a7f51bb4593fno verificadovulncheckvulncheck.com/xdb/1293a1a85b89no verificadovulncheckvulncheck.com/xdb/baa23d069da5no verificadovulncheckvulncheck.com/xdb/72f85a29c165no verificadovulncheckvulncheck.com/xdb/31a2493d581cno verificadovulncheckvulncheck.com/xdb/b2f2b26f8c21no verificadovulncheckvulncheck.com/xdb/b89478e4dff2no verificadovulncheckvulncheck.com/xdb/99729775468dno verificadovulncheckvulncheck.com/xdb/c711254ccffcno verificadovulncheckvulncheck.com/xdb/1c48e403c9e9no verificadovulncheckvulncheck.com/xdb/47c366ae2f29no verificadovulncheckvulncheck.com/xdb/6ec76e8d16e1no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.htmlhttps://access.redhat.com/errata/RHBA-2019:2824https://access.redhat.com/errata/RHSA-2019:2860https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7609https://www.elastic.co/community/security