CVE-2019-7609

CriticalCVSS 10.0/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Elastic	Kibana	before 5.6.15 and 6.6.1

References

http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHBA-2019:2824Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2860Third Party Advisory
https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077Vendor Advisory
https://www.elastic.co/community/securityBroken Link, Vendor Advisory
http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHBA-2019:2824Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2860Third Party Advisory
https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077Vendor Advisory
https://www.elastic.co/community/securityBroken Link, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7609US Government Resource

Timeline

Published: Mar 25, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 10, 2022
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-76109.0Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpa CVE-2019-76118.1A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are dis CVE-2019-76129.8A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is s CVE-2019-76137.5Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An attacker able to inject certain characters into a log entry CVE-2019-76145.9A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with CVE-2019-76157.4A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certifi CVE-2019-76164.9Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer CVE-2019-76177.2When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker CVE-2019-76186.5A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Cod CVE-2019-76195.3Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated a CVE-2019-76207.5Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is CVE-2019-76215.4Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacke