RCE in Elastic Kibana
CVE-2020-7013
Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.021 (81.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 81.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.021 · newest: 0.021 · change: 0.000
Affected products
- Elastic Kibana — versions before 6.8.9 and 7.7.0
- Red Hat Openshift Container Platform — versions 3.11, 4.0
Weakness classification (CWE)
References
- www.elastic.co/community/security/ (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-7013?
- CVE-2020-7013 is a high-severity vulnerability in Elastic Kibana, classified under Code Injection. CVSS score: 7.2/10. Published 2020-06-03.
- How severe is CVE-2020-7013?
- High severity. CVSS v3 base score is 7.2 out of 10.