CVE-2020-7012
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-7012
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Elasticsearch Kibana 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Elasticsearch Kibana是荷兰Elasticsearch公司的一套开源的、基于浏览器的分析和搜索Elasticsearch仪表板工具。 Elasticsearch Kibana 6.7.0版本至6.8.8版本和7.0.0版本至7.6.2版本中的Upgrade Assistant存在代码注入漏洞。攻击者可利用该漏洞在Kibana进程的上下文中执行代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2020-7012
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Kibana%207.6.2%20upgrade-assistant-telemetry%20%E5%8E%9F%E5%9E%8B%E6%B1%A1%E6%9F%93%E5%AF%BC%E8%87%B4%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%20CVE-2020-7012.md | POC Details |
| 2 | https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2020-7012/README.md | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-7012
请登录查看更多情报信息。
- https://www.elastic.co/community/security/x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2020-7012
Same Patch Batch · Elastic · 2020-06-03 · 6 CVEs total
| CVE-2020-7010 | Elastic Cloud on Kubernetes 安全漏洞 | |
| CVE-2020-7011 | Elastic App Search 跨站脚本漏洞 | |
| CVE-2020-7013 | Elasticsearch Kibana 代码注入漏洞 | |
| CVE-2020-7014 | Elasticsearch 安全漏洞 | |
| CVE-2020-7015 | Elasticsearch Kibana 跨站脚本漏洞 |
IV. Related Vulnerabilities
Same product: Kibana
- CVE-2026-33458
Server-Side Request Forgery (SSRF) in Kibana One Workflow Le - CVE-2026-33459
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-33460
Incorrect Authorization in Kibana Fleet Leading to Informati - CVE-2026-33461
Incorrect Authorization in Kibana Fleet Leading to Informati - CVE-2026-4498
Execution with Unnecessary Privileges in Kibana Leading to r
Same vendor: Elastic
- CVE-2026-33467
Improper Verification of Cryptographic Signature in Elastic - CVE-2026-33466
Improper Limitation of a Pathname to a Restricted Directory - CVE-2026-33458
Server-Side Request Forgery (SSRF) in Kibana One Workflow Le - CVE-2026-33459
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-33460
Incorrect Authorization in Kibana Fleet Leading to Informati
Same weakness: CWE-94
- CVE-2021-47939
Evolution CMS 3.1.6 Authenticated Remote Code Execution via - CVE-2021-47938
ImpressCMS 1.4.2 Remote Code Execution via Autotasks - CVE-2021-47935
Sentry 8.2.0 Remote Code Execution via Pickle Deserializatio - CVE-2022-50944
Aero CMS 0.0.1 PHP Code Injection via posts.php - CVE-2026-8211
codelibs Fess JSP File AdminDesignAction.java update code in
V. Comments for CVE-2020-7012
No comments yet