{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T09:29:23.986","vulnerabilities":[{"cve":{"id":"CVE-2020-7012","sourceIdentifier":"security@elastic.co","published":"2020-06-03T18:15:22.857","lastModified":"2026-06-17T03:24:07.277","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system."},{"lang":"es","value":"Kibana versiones 6.7.0 hasta 6.8.8 y 7.0.0 hasta 7.6.2, contienen un fallo contaminación de prototipo en el Upgrade Assistant. Un atacante autenticado con privilegios para escribir en el índice de Kibana podría insertar datos que harían que Kibana ejecutara código arbitrario. Esto podría conllevar posiblemente a que un atacante ejecute código con los permisos del proceso de Kibana en el sistema host."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Kibana","versions":[{"version":"6.7.0 to 6.8.8 and 7.0.0 to 7.6.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7.0","versionEndIncluding":"6.8.8","matchCriteriaId":"430EE754-4FF0-41C4-BE1D-3BEB042E98FA"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndIncluding":"7.6.2","matchCriteriaId":"6A924300-1A1E-4244-B734-3BFAB553A9F5"}]}]}],"references":[{"url":"https://www.elastic.co/community/security/","source":"security@elastic.co","tags":["Vendor Advisory"]},{"url":"https://www.elastic.co/community/security/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}