Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana access could set the timelion:graphite.url configuration option to an arbitrary URL. This could possibly lead to an attacker accessing external URL resources as the Kibana process on the host system.

An update of the kibana package has been released.

According to its self-reported version number, the Kibana application running on the remote host is prior to 6.8.2 or 7.x prior to 7.2.1. It is, therefore, affected by :

 - A prototype pollution vulnerability in lodash. (CVE-2019-10744)

 - A server-side request forgery (SSRF) vulnerability in the graphite integration for Timelion visualizer. (CVE-2019-7616)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
137639	Photon OS 1.0: Kibana PHSA-2020-1.0-0301	Nessus	PhotonOS Local Security Checks	high
136578	Photon OS 3.0: Kibana PHSA-2020-3.0-0088	Nessus	PhotonOS Local Security Checks	medium
98980	Kibana 7.x < 7.2.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98979	Kibana < 6.8.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2019-7616

medium

Tenable Plugins

high

medium

critical

critical