Elastic Kibana fixes 2 critical vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Elastic Kibana fixes 2 critical vulnerabilities

Elastic Kibana version 8.15.1 fixes 2 critical vulnerabilities. If an update is not possible, the issue for CVE-2024-37288 can be mitigated by disabling the Integration Assistant using the setting 'xpack.integration_assistant.enabled: false' in the kibana.yml configuration file [1].

Elastic Kibana - arbitrary code execution (CVE-2024-37288)

CVSS 9.9 (Critical)

Allows an authenticated remote attacker to execute arbitrary code if Kibana attempts to parse a YAML document containing a malicious payload. This vulnerability affects only users who use the integrated Elastic Security artificial intelligence tools and have an Amazon Bedrock connector configured [1].

The vulnerability is present in product:

Kibana; =8.15.0

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

CVE-2024-37288 at cve.org, NVD
CWE-502: Deserialization of Untrusted Data at cwe.mitre.org

The vulnerability was publicly disclosed 14. 11. 2024.

Elastic Kibana - arbitrary code execution (CVE-2024-37285)

CVSS 9.1 (Critical)

Allows an authenticated remote attacker who has a combination of specific index privileges in Elasticsearch and privileges in Kibana to execute arbitrary code if Kibana attempts to parse a YAML document containing a malicious payload [1].

The vulnerability is present in product:

Elastic Kibana; >=8.10.0, <=8.15.0

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

CVE-2024-37285 at cve.org, NVD
CWE-CWE-502: Deserialization of Untrusted Data at cwe.mitre.org

The vulnerability was publicly disclosed 14. 11. 2024.

Report feedback

[TLP:CLEAR] Elastic Kibana fixes 2 critical vulnerabilities

Elastic Kibana - arbitrary code execution (CVE-2024-37288)

CVSS 9.9 (Critical)

Elastic Kibana - arbitrary code execution (CVE-2024-37285)

CVSS 9.1 (Critical)

Links