BIT-elk-2024-37279

vendorUSosv

Kibana Broken Access Control issue

view advisory published 2024-06-17Licence: per source

A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-37279US	medium4.3	0.37% (31st)	—	2024-06-13
A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availabili…

references

External citations — patches, advisories, analysis.

https://discuss.elastic.co/t/kibana-8-14-0-security-update-esa-2024-15/360887ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2024-37279WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan