Vulnerability Description
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Kibana | >= 8.0.0, <= 8.7.0 |
Related Weaknesses (CWE)
References
- https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330Vendor Advisory
- https://www.elastic.co/community/security/Vendor Advisory
- https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330Vendor Advisory
- https://www.elastic.co/community/security/Vendor Advisory
FAQ
What is CVE-2023-31414?
CVE-2023-31414 is a vulnerability with a CVSS score of 8.8 (HIGH). Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execut...
How severe is CVE-2023-31414?
CVE-2023-31414 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-31414?
Check the references section above for vendor advisories and patch information. Affected products include: Elastic Kibana.