CVE-2019-7609
100Vexday Risk Score
Corrija agora. Ela está sob exploração confirmada pelo CISA e tem exploit funcional público.
ssvc Actcvss 9.8epss 95%
da publicação à arma207 dias
Publicada no NVD25 de mar.
1ª PoC+207d
metasploit+219d
CISA KEV+1022d
probabilidade de exploração
95%top 1% das CVEs
exploração observada
simCISA + VulnCheck
26 exploit(s) público(s)
Ação exigida pela CISAprazo federal: 2022-07-10
Apply updates per vendor instructions.
Pesquisado e redigido com IA a partir do advisory do fornecedor e de análises públicas, com as fontes acima. Confira sempre a versão corrigida no advisory oficial antes de agir.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Elastic · KibanaPoCs públicas encontradas — 26
githubgithub.com/LandGrey/CVE-2019-7609★ 167githubgithub.com/jas502n/kibana-RCE★ 89githubgithub.com/mpgn/CVE-2019-7609★ 56githubgithub.com/hekadan/CVE-2019-7609★ 21githubgithub.com/Cr4ckC4t/cve-2019-7609★ 4githubgithub.com/rhbb/CVE-2019-7609★ 1githubgithub.com/dnr6419/CVE-2019-7609★ 1githubgithub.com/Akshay15-png/CVE-2019-7609★ 1githubgithub.com/wolf1892/CVE-2019-7609★ 0githubgithub.com/aleister1102/kibana-prototype-pollusion★ 0githubgithub.com/toxxxaka/CVE-2019-7609★ 0githubgithub.com/d0x-awrqxavc/CVE-2019-7609-KibanaRCE★ 0vulncheckvulncheck.com/xdb/e88fe8b26b66não verificadocve_referencepacketstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.htmlnão verificadovulncheckvulncheck.com/xdb/a7f51bb4593fnão verificadovulncheckvulncheck.com/xdb/1293a1a85b89não verificadovulncheckvulncheck.com/xdb/baa23d069da5não verificadovulncheckvulncheck.com/xdb/72f85a29c165não verificadovulncheckvulncheck.com/xdb/31a2493d581cnão verificadovulncheckvulncheck.com/xdb/b2f2b26f8c21não verificadovulncheckvulncheck.com/xdb/b89478e4dff2não verificadovulncheckvulncheck.com/xdb/99729775468dnão verificadovulncheckvulncheck.com/xdb/c711254ccffcnão verificadovulncheckvulncheck.com/xdb/1c48e403c9e9não verificadovulncheckvulncheck.com/xdb/47c366ae2f29não verificadovulncheckvulncheck.com/xdb/6ec76e8d16e1não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.htmlhttps://access.redhat.com/errata/RHBA-2019:2824https://access.redhat.com/errata/RHSA-2019:2860https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7609https://www.elastic.co/community/security