CVE-2019-7616

—

CVSS 3.1

4.9 medium

EPSS

2%p83

Published

Jul 30, 2019 (Jul 30, 2019)

Modified

Jun 17, 2026

Description

Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana access could set the timelion:graphite.url configuration option to an arbitrary URL. This could possibly lead to an attacker accessing external URL resources as the Kibana process on the host system.

Vendors: elastic
Products: kibana
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (2.4%)

In the news0 stories

No ingested article mentions this CVE yet.