This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Elastic Kibana fixes 4 vulnerabilities
Elastic Kibana version 8.15.0 fixes 4 vulnerabilities [1][2].
Allows an authenticated remote attacker without access to Fleet to view Elastic Agent policies, which may contain sensitive information [1].
The vulnerability is present in product:
- *:Kibana; >=8.0.0, <8.15.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
More information:
- CVE-2024-43707 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 22. 1. 2025.
Allows an authenticated remote attacker with read permission for any feature, due to unrestricted resource allocation, to crash the system by means of a specially crafted payload sent to certain inputs in the Kibana user interface [2].
The vulnerability is present in product:
- *:Kibana; >=7.0.0, >7.17.23; >=8.0.0, <=8.15.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-43708 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 22. 1. 2025.
Allows an authenticated remote attacker with read access to the Observability Metrics or Logs features in Kibana, due to unrestricted resource allocation, to crash the system using a specially crafted request to /api/metrics/snapshot [2].
The vulnerability is present in product:
- *:Kibana; >=7.0.0, <7.17.23; >=8.0.0, <8.15.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-52972 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 23. 1. 2025.
Allows an authenticated remote attacker with read access in Fleet, due to a server-side request forgery vulnerability in the /api/fleet/health_check API, to make requests to internal endpoints [1].
The vulnerability is present in product:
- *:Kibana; >=8.7.0, <8.15.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
More information:
- CVE-2024-43710 at cve.org, NVD
- CWE-918: Server-Side Request Forgery (SSRF) at cwe.mitre.org
The vulnerability was publicly disclosed 22. 1. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 23. 1. 2025.