{"id":"CVE-2023-31415","published":"2023-05-04T00:00:00Z","modified":"2025-01-29T18:00:20Z","title":"Kibana version 8.7.0 contains an arbitrary code execution flaw","vendor":"Elastic","product":"Kibana","tier":"tail","description":{"text":"Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00957,"percentile":0.61336,"provenance":"source"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://www.elastic.co/community/security/","tags":[]},{"url":"https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330","tags":[]}],"priority":{"score":19.2,"factors":[{"name":"EPSS percentile","points":12.27},{"name":"CVSS severity","points":6.93}]},"vendorSlug":"elastic","affectedVersions":[{"vendor":"Elastic","product":"Kibana","versions":["version 8.7.0"]}],"euvd":{"id":"EUVD-2023-35726","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-elastic-kibana-cwe-94"}}