« Volver al listado

CVE-2019-7618

Estado: ModificadaMedia (6.5)—

A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana system user.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Elastic — Kibana

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-7618",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@elastic.co",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Elastic Code",
          "versions": [
            {
              "status": "affected",
              "version": "7.3.0, 7.3.1, and 7.3.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-10-01T18:15:13.987",
  "references": [
    {
      "url": "https://discuss.elastic.co/t/elastic-stack-7-4-0-security-update/201831",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "security@elastic.co"
    },
    {
      "url": "https://staging-website.elastic.co/community/security",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "security@elastic.co"
    },
    {
      "url": "https://discuss.elastic.co/t/elastic-stack-7-4-0-security-update/201831",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://staging-website.elastic.co/community/security",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@elastic.co",
      "description": [
        {
          "lang": "en",
          "value": "CWE-538"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana system user."
    },
    {
      "lang": "es",
      "value": "Se encontró un fallo de divulgación de archivo local en Elastic Code versiones 7.3.0, 7.3.1 y 7.3.2. Si un repositorio de código malicioso es importado hacia Code, es posible leer archivos arbitrarios del sistema de archivos local de la instancia Kibana ejecutando Code con el permiso del usuario system de Kibana."
    }
  ],
  "lastModified": "2026-06-17T02:40:46.220",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elastic:kibana:7.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2F9EBE3-54B9-410E-9B22-6A4671735765"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:7.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F08B1343-B6DB-435B-8913-9EBAC66B5D00"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:7.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D73DD3D7-F0E2-4BA3-8BD9-637E872CA121"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@elastic.co"
}