QwikSec

Security Database

CVE

CWE

Training

CVE-2023-31415

Published: May 4, 2023

Modified: Jan 29, 2025

PUBLISHED

Description

Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.

Vendor	Product	Versions
Elastic	Kibana	affected `version 8.7.0`

Weaknesses (CWE)

References

https://www.elastic.co/community/security/

https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.