CVE-2020-7016

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user can lead to the Kibana process consuming large amounts of CPU and becoming unresponsive.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-185 CWE-400

Affected software

Vendor	Product	Versions
Elastic	Kibana	before 6.8.11 and 7.8.1

References

https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update/242786Release Notes, Vendor Advisory
https://www.elastic.co/community/security/Vendor Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update/242786Release Notes, Vendor Advisory
https://www.elastic.co/community/security/Vendor Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory

Timeline

Published: Jul 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-70176.7In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or cr CVE-2020-70188.8Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the ï¿½developerï¿CVE-2020-70196.5In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a u CVE-2020-70203.1Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search quer CVE-2020-70214.9Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is CVE-2020-70298.8A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communicatio CVE-2020-70305.5A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a loc CVE-2020-70326.5An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct serv CVE-2020-70335.4A Cross Site Scripting (XSS) Vulnerability on the Unified Portal Client (web client) used in Avaya Equinox Conferencing can allow an authent CVE-2020-70348.8A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send sp CVE-2020-70356.5An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticate CVE-2020-70366.5An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to informat