CVE-2019-7609

🗓️ 25 Mar 2019 00:00:00Reported by elasticType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 1233 Views🌐 WEB

Kibana versions before 5.6.15 and 6.6.1 allow arbitrary code execution via Timelion

Reporter	Title	Published	Views	Family All 59
0day.today	Kibana Timelion Prototype Pollution Remote Code Execution Exploit	11 Sep 202300:00	–	zdt
Gitee	Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform	8 Dec 202020:38	–	gitee
Gitee	Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform	6 May 202015:20	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Safari	23 Jan 202218:42	–	gitee
GithubExploit	Exploit for Code Injection in Elastic Kibana	21 Oct 201907:32	–	githubexploit
GithubExploit	PoC_n_Dockerfile_4_PentestFinalProject_Group02	14 Apr 202614:38	–	githubexploit
GithubExploit	Exploit for Type Confusion in Adobe Acrobat_Dc	25 Oct 202511:16	–	githubexploit
GithubExploit	Exploit for Code Injection in Elastic Kibana	21 Oct 201915:31	–	githubexploit
GithubExploit	Exploit for Code Injection in Elastic Kibana	24 Aug 202104:38	–	githubexploit
Tenable Nessus	Kibana 5.x < 5.6.15 / 6.x < 6.6.1 Multiple Vulnerabilities	24 Oct 201900:00	–	nessus

NVD

Node

elastic kibanaRange<5.6.15

elastic kibanaRange6.0.0–6.6.1

Node

redhat openshift_container_platformMatch3.11

redhat openshift_container_platformMatch4.1

[
  {
    "vendor": "Elastic",
    "product": "Kibana",
    "versions": [
      {
        "version": "before 5.6.15 and 6.6.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.html
discuss	www.discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077
elastic	www.elastic.co/community/security
access	www.access.redhat.com/errata/RHSA-2019:2860
access	www.access.redhat.com/errata/RHBA-2019:2824
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
EIO	query param	socket.io/	Socket.IO polling endpoint used to trigger payload delivery/execution.	CWE-94
transport	query param	socket.io/	Socket.IO polling endpoint used to trigger payload delivery/execution.	CWE-94
sheet	request body	api/timelion/run	Timelion run API vulnerable to payload injection via the sheet payload.	CWE-94
time	request body	api/timelion/run	Timelion run API vulnerable to payload injection via the sheet payload.	CWE-94
from	request body	api/timelion/run	Timelion run API vulnerable to payload injection via the sheet payload.	CWE-94
to	request body	api/timelion/run	Timelion run API vulnerable to payload injection via the sheet payload.	CWE-94
mode	request body	api/timelion/run	Timelion run API vulnerable to payload injection via the sheet payload.	CWE-94
interval	request body	api/timelion/run	Timelion run API vulnerable to payload injection via the sheet payload.	CWE-94
timezone	request body	api/timelion/run	Timelion run API vulnerable to payload injection via the sheet payload.	CWE-94

07 Nov 2025 19:36Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8 - 10

CVSS 210

EPSS0.94429

SSVC