{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-29T23:00:59.639","vulnerabilities":[{"cve":{"id":"CVE-2019-7610","sourceIdentifier":"security@elastic.co","published":"2019-03-25T19:29:02.197","lastModified":"2026-06-17T02:40:45.410","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system."},{"lang":"es","value":"Kibana anterior a versión 6.6.1, contienen un fallo de ejecución de código arbitrario en el registrador de auditoría de seguridad. Si una instancia de Kibana presenta la configuración xpack.security.audit.enabled establecida en true, un atacante podría enviar una petición que intente ejecutar código javascript. Esto podría conllevar a un atacante a ejecutar comandos arbitrarios con permisos del proceso kibana en el sistema host."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Kibana","versions":[{"version":"before 6.6.1","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-77"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionEndExcluding":"5.6.15","matchCriteriaId":"54F3E4CC-2877-4CA8-A2EB-3CB9F32855E2"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.6.1","matchCriteriaId":"9870EC64-EDCA-436F-BE44-827E8ECA38F9"}]}]}],"references":[{"url":"https://access.redhat.com/errata/RHBA-2019:2824","source":"security@elastic.co"},{"url":"https://access.redhat.com/errata/RHSA-2019:2860","source":"security@elastic.co"},{"url":"https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077","source":"security@elastic.co","tags":["Vendor Advisory"]},{"url":"https://www.elastic.co/community/security","source":"security@elastic.co","tags":["Vendor Advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2019:2824","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2860","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://www.elastic.co/community/security","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}