Описание
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.
Ссылки
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
9.1 Critical
CVSS3
7.2 High
CVSS3
Дефекты
Связанные уязвимости
A flaw allowing arbitrary code execution was discovered in Kibana. An ...
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.
Уязвимость функций коннектора ML и Alerting сервиса визуализации данных Kibana, позволяющая нарушителю выполнить произвольный код
EPSS
9.1 Critical
CVSS3
7.2 High
CVSS3