Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.

According to its self-reported version number, the Kibana application running on the remote host is 6.7.0 prior to 7.0.0. It is, therefore, affected by : 

- A Prototype Pollution in Upgrade Assistant (CVE-2020-7012)

- A Prototype Pollution in TSVB visualizartion (CVE-2020-7013)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the kibana package has been released.

ID	Name	Product	Family	Severity
113536	Kibana 6.7.0 < 7.7.0 Prototype Pollution	Web App Scanning	Component Vulnerability	high
137723	Photon OS 3.0: Kibana PHSA-2020-3.0-0103	Nessus	PhotonOS Local Security Checks	high
137713	Photon OS 2.0: Kibana PHSA-2020-2.0-0253	Nessus	PhotonOS Local Security Checks	high
137639	Photon OS 1.0: Kibana PHSA-2020-1.0-0301	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2020-7012

high

Tenable Plugins

high

high

high

high