Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2019-7616

Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana access could set the timelion:graphite.url configuration option to an arbitrary URL. This could possibly lead to an attacker accessing external URL resources as the Kibana process on the host system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Kibana

  • before 7.2.1 and 6.8.2affected

References