PT-2023-23308 · Elastic · Kibana

Published 2023-05-04 · Updated 2026-03-01 · CVE-2023-31415

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kibana version 8.7.0

Description The issue is an arbitrary code execution flaw. An attacker with all privileges to the Uptime/Synthetics feature could send a request to execute JavaScript code, potentially leading to the execution of arbitrary commands on the host system with the permissions of the Kibana process.

Recommendations For Kibana version 8.7.0, consider disabling the Uptime/Synthetics feature until a patch is available to prevent potential exploitation. Restrict access to the feature to minimize the risk of arbitrary code execution.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-31415

Affected Products

Kibana

References · 7

• https://elastic.co/community/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31415 · Vendor Advisory
• https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31415 · Security Note
• https://t.me/cibsecurity/63327 · Telegram Post
• https://twitter.com/audn_ai/status/2027951506893279717 · Twitter Post
• https://twitter.com/audn_ai/status/2027952930272236011 · Twitter Post