This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Elastic Kibana fixes a critical vulnerability

Elastic Kibana versions 8.14.2 and 7.17.23 fix a critical vulnerability. If updating is not possible, the company recommends mitigating the impact by reviewing the security of user permissions; the Connector Actions and Machine Learning features can also be disabled if they are not required [1].

Elastic Kibana - arbitrary code execution (CVE-2024-37287)
CVSS 9.1 (Critical)

Allows an authenticated remote attacker with access to the Machine Learning and Alerting connector features and write access to internal Machine Learning indices to trigger a "prototype pollution" [2] vulnerability and execute arbitrary code [1].

The vulnerability is present in product:

  • Kibana; >=8.0.0, <8.14.2; >=7.7.0, <7.17.23

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2024-37287 at cve.org, NVD
  • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') at cwe.mitre.org

The vulnerability was publicly disclosed 6. 8. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 15. 8. 2024.

CESNET, z.s.p.o. Logo