Kibana Arbitrary Code Execution. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/01/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| kibana | ≥ 6.0.0, < 6.6.1< 5.6.15 | 6.6.15.6.15 |
| openshift container platform | = 3.11= 4.1 |
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free