CVE-2019-7609

🗓️ 25 Mar 2019 00:00:00Reported by elasticType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 1257 Views🌐 WEB

Kibana versions before 5.6.15 and 6.6.1 allow arbitrary code execution via Timelion

Reporter	Title	Published	Views	Family All 60
0day.today	Kibana Timelion Prototype Pollution Remote Code Execution Exploit	11 Sep 202300:00	–	zdt
Gitee	Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform	8 Dec 202020:38	–	gitee
Gitee	Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform	6 May 202015:20	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Safari	23 Jan 202218:42	–	gitee
GithubExploit	Exploit for Code Injection in Elastic Kibana	21 Oct 201907:32	–	githubexploit
GithubExploit	PoC_n_Dockerfile_4_PentestFinalProject_Group02	14 Apr 202614:38	–	githubexploit
GithubExploit	Exploit for Type Confusion in Adobe Acrobat_Dc	25 Oct 202511:16	–	githubexploit
GithubExploit	Exploit for Code Injection in Elastic Kibana	21 Oct 201915:31	–	githubexploit
GithubExploit	Exploit for Code Injection in Elastic Kibana	24 Aug 202104:38	–	githubexploit
Tenable Nessus	Kibana 5.x < 5.6.15 / 6.x < 6.6.1 Multiple Vulnerabilities	24 Oct 201900:00	–	nessus

NVD

Node

elastic kibanaRange<5.6.15

elastic kibanaRange6.0.0–6.6.1

Node

redhat openshift_container_platformMatch3.11

redhat openshift_container_platformMatch4.1

[
  {
    "vendor": "Elastic",
    "product": "Kibana",
    "versions": [
      {
        "version": "before 5.6.15 and 6.6.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.html
discuss	www.discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077
elastic	www.elastic.co/community/security
access	www.access.redhat.com/errata/RHSA-2019:2860
access	www.access.redhat.com/errata/RHBA-2019:2824
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
sheet	request body	/api/timelion/run	Kibana Timelion run endpoint vulnerability allowing injection that can lead to remote code execution	CWE-94
time	request body	/api/timelion/run	Kibana Timelion run endpoint vulnerability allowing injection that can lead to remote code execution	CWE-94

17 Jun 2026 02:40Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8 - 10

CVSS 210

EPSS0.95338

SSVC