This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Elasticsearch and Kibana fix 3 vulnerabilities
Elastic is fixing 3 vulnerabilities in Elasticsearch and Kibana in version 8.14.0 [1][2][3].
An authenticated remote attacker can gain unauthorized access to some documents in Elasticsearch through search [1].
The vulnerability is present in product:
- Elasticsearch; >=8.10.0, <8.14.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2024-23445 at cve.org, NVD
- CWE-284 at cwe.mitre.org
The vulnerability was publicly disclosed 6. 6. 2024.
An authenticated remote attacker can carry out a DoS attack in Elasticsearch using the document processing functionality [2].
The vulnerability is present in product:
- Elasticsearch; >=8.13.1, <8.14.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-37280 at cve.org, NVD
- CWE-121 at cwe.mitre.org
The vulnerability was publicly disclosed 7. 6. 2024.
An authenticated remote attacker with view permissions can carry out a DoS attack in Kibana using alerting rules [3].
The vulnerability is present in product:
- Kibana; >=8.6.3, <8.14.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
More information:
- CVE-2024-37279 at cve.org, NVD
- CWE-400 at cwe.mitre.org
The vulnerability was publicly disclosed 5. 6. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 10. 6. 2024.