Arbitrary Code Execution Vulnerability in Kibana by Elastic

CVE-2023-31415

What is CVE-2023-31415?

In Kibana version 8.7.0, an arbitrary code execution vulnerability has been identified that allows an attacker with all privileges to the Uptime/Synthetics feature to send a specially crafted request. This request can execute arbitrary JavaScript code on the server, potentially allowing the attacker to run commands with the same permissions as the Kibana process. This poses a serious security risk, as it could enable unauthorized access to host systems and sensitive data.

References