QwikSec

Security Database

CVE

CWE

Training

CVE-2023-31414

Published: May 4, 2023

Modified: Jan 29, 2025

PUBLISHED

Description

Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.

Vendor	Product	Versions
Elastic	Kibana	affected `versions 8.0.0 through 8.7.0`

Weaknesses (CWE)

References

https://www.elastic.co/community/security/

https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.