CVE-2019-7609
KEVCRITICAL 10.0EPSS 95.3%
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
- Affected
- Elastic · Kibana
- CVSS v3.1 NVD
- 10.0 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS v3.1 CNA
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 95.34% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2022-01-10
- Nuclei
- critical · CWE-94
- Published
- 2019-03-25
- Updated
- 2025-10-21
Proof-of-concept exploits (12)
- http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Co…
- Akshay15-png/CVE-2019-76091★ · 2024-07-30
- Cr4ckC4t/cve-2019-76094★ · 2022-03-17
- LandGrey/CVE-2019-7609165★ · 2023-08-29
- Mrnmap/KibanaRce2★ · 2019-10-27
- OliveiraaX/CVE-2019-7609-KibanaRCE0★ · 2023-07-17
- dnr6419/CVE-2019-76091★ · 2021-08-25
- hekadan/CVE-2019-760920★ · 2019-12-01
- rhbb/CVE-2019-76091★ · 2020-04-03
- wolf1892/CVE-2019-76090★ · 2022-02-10
- toxxxaka/CVE-2019-76090★ · 2026-02-17
- SOJU001/Sec-TryHackMe0★ · 2026-09-17
Nuclei templates (1)
Metasploit modules (1)
Vulhub environments (1)
Security advisories
- https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077
- https://www.elastic.co/community/security
- https://access.redhat.com/errata/RHBA-2019:2824
- https://access.redhat.com/errata/RHSA-2019:2860