CVE-2019-7618: elastic elastic code
CVSS: 6.5v3.1MediumModified
Published 01-10-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-7618 is a medium (CVSS 6.5) vulnerability in elastic elastic code. EPSS estimates a 1.45% chance of exploitation in the next 30 days, higher than 73% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
1.45%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 01-10-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana system user.
CVSS metrics
2 scores · 1 source · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSourcesSingle source
Low 3.5Preferred score · NVD (NIST)
AV:N/AC:M/Au:S/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
1.45%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
0.00 pp
From 1.45% on 19-09-2026
19-09-202619-10-2026
EPSS score1.45%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-538Insertion of Sensitive Information into Externally-Accessible File or DirectoryThe product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Affected systems
Elastic2 products
- elastic code7.3.0, 7.3.1, and 7.3.2
- kibanaEOL7.3.0 | 7.3.1 | 7.3.2
1 vendor · 2 products
References
2 links- discuss.elastic.co/t/elastic-stack-7-4-0-security-update/201831X Refsource MISCRelease NotesVendor Advisory