CVE-2019-7616

Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana access could set the timelion:graphite.url configuration option to an arbitrary URL. This could possibly lead to an attacker accessing external URL resources as the Kibana process on the host system.

Score

CVSS 3.1 4.9 Medium

Status

Modified - security@elastic.co

Published

2019-07-30

Last modified

2024-08-04

Weaknesses

CWE-918

Affected products

• Kibana (Elastic)

References

• https://www.elastic.co/community/security/