CVE-2020-7016 Denial of service in Kibana
An attacker can cause Kibana to become unresponsive by tricking a user into viewing a malicious Timelion URL, leading to high CPU consumption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-7016?
CVE-2020-7016 is a medium-severity denial of service vulnerability in Oracle Communications Billing and Revenue Management, published on 27 Jul 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user can lead to the Kibana process consuming large amounts of CPU and becoming unresponsive.
Which versions are affected by CVE-2020-7016?
2 open source packages ship an affected version, including elk and kibana. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
elk Bitnami | All versions | 6.8.11, 7.8.1 |
kibana Bitnami | All versions | 6.8.11, 7.8.1 |
Products include Elasticsearch Kibana, Oracle Communications Billing and Revenue Management, Oracle Communications Cloud Native Core Network Function Cloud Native Environment, Oracle Peoplesoft Enterprise Peopletools.
How do I fix CVE-2020-7016?
Upgrade elk to a fixed version for your release line: 6.8.11 or 7.8.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-7016 being exploited?
There is no known exploitation of CVE-2020-7016 in the wild and no public exploit code.
Other vulnerabilities in Oracle Communications Billing and Revenue Management
All Oracle Communications Billing and Revenue Management vulnerabilities
Sources
Also known as BIT-elk-2020-7016, BIT-kibana-2020-7016, GHSA-hrj2-4hpm-cjw9.