PT-2023-23307 · Elastic · Kibana

Published 2023-05-04 · Updated 2025-01-29 · CVE-2023-31414

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kibana versions 8.0.0 through 8.7.0

Description The issue is an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.

Recommendations For Kibana versions 8.0.0 through 8.7.0, update to a version that contains a fix for this issue to prevent arbitrary code execution. As a temporary workaround, consider restricting write access to Kibana yaml or env configuration to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-31414

Affected Products

Kibana

References · 7

• https://elastic.co/community/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31414 · Vendor Advisory
• https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31414 · Security Note
• https://t.me/cvenotify/109058 · Telegram Post
• https://t.me/cibsecurity/63338 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31414 · Note