BIT-elk-2024-43710

vendorUSosv

Kibana server-side request forgery

view advisory published 2025-01-27Licence: per source

A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-43710US	—	0.26% (18th)	—	2025-01-23
A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature o…

references

External citations — patches, advisories, analysis.

https://discuss.elastic.co/t/kibana-8-15-0-security-update-esa-2024-29-esa-2024-30/373521ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2024-43710WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan