DeutschShown in its original language — a full translation is planned for a future version.
Elasticsearch/Kibana: Mehrere Schwachstellen
view advisory published 2019-07-30
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Elasticsearch und Kibana ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen, Sicherheitsmechanismen zu umgehen und Informationen offenzulegen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-7616US | medium4.9 | Exploit | ||
Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana… | ||||
| CVE-2019-7614US | medium5.9 | — | ||
A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it… | ||||
| CVE-2019-10744US | critical9.1 | Exploit | ||
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype usin… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2019:3024 vom 2019-10-10external
- Red Hat Security Advisory RHSA-2020:2362 vom 2020-06-02external
- Red Hat Security Advisory RHSA-2020:2819 vom 2020-07-06external
- Elastic Stack 6.8.2 and 7.2.1 security update vom 2019-07-30external
- SolarWinds Platform 2024.4 release notes vom 2024-10-16external
- F5 Security Advisory K47105354 vom 2019-11-13external
- WID-SEC-W-2024-3184 - CSAF Versionself
- WID-SEC-2024-3184 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan