CVE-2019-7616

MEDIUM

Kibana < 6.8.2 - Authenticated Server-Side Request Forgery via Timelion Graphite URL Configuration

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-7616. PoCs published by random-robbie.

AI-analyzed exploit summary This PoC demonstrates a blind SSRF vulnerability in Kibana 6.7.0 by exploiting the Timelion plugin to make arbitrary HTTP requests. It sends a crafted payload to modify settings and trigger an SSRF to a specified URL.

Description

Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana access could set the timelion:graphite.url configuration option to an arbitrary URL. This could possibly lead to an attacker accessing external URL resources as the Kibana process on the host system.

Exploits (1)

nomisec WORKING POC 6 stars
by random-robbie · poc
https://github.com/random-robbie/CVE-2019-7616

This PoC demonstrates a blind SSRF vulnerability in Kibana 6.7.0 by exploiting the Timelion plugin to make arbitrary HTTP requests. It sends a crafted payload to modify settings and trigger an SSRF to a specified URL.

Classification
Working Poc 90%
Attack Type
Ssrf
Complexity
Moderate
Reliability
Reliable
Target: Kibana 6.7.0
No auth needed
Prerequisites: Access to the Kibana instance · Network connectivity to the target SSRF URL
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Vendor Advisory x_refsource_misc
https://www.elastic.co/community/security/

Scores

CVSS v3 4.9
EPSS 0.0214
EPSS Percentile 79.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-918
Status published
Products (1)
elastic/kibana < 6.8.2
Published Jul 30, 2019
Tracked Since Feb 18, 2026