CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-37287 – Kibana arbitrary code execution via prototype pollution
https://notcve.org/view.php?id=CVE-2024-37287
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution. • https://discuss.elastic.co/t/kibana-8-14-2-7-17-23-security-update-esa-2024-22 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23443
https://notcve.org/view.php?id=CVE-2024-23443
A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack. Un usuario con altos privilegios, al que se le permite crear paquetes de osquery personalizados 17, podría afectar la disponibilidad de Kibana al cargar un paquete de osquery creado con fines malintencionados. • https://discuss.elastic.co/t/kibana-8-14-0-7-17-22-security-update-esa-2024-11/361460 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23442 – Kibana open redirect issue
https://notcve.org/view.php?id=CVE-2024-23442
An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. Se descubrió un problema de redireccionamiento abierto en Kibana que podría llevar a que un usuario sea redirigido a un sitio web arbitrario si utiliza una URL de Kibana manipulada con fines malintencionados. • https://discuss.elastic.co/t/kibana-8-14-0-7-17-22-security-update/361502 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37279 – Kibana Broken Access Control issue
https://notcve.org/view.php?id=CVE-2024-37279
A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries. Se descubrió una falla en Kibana, que permite a los usuarios de alertas de solo visualización usar la API run_soon, lo que hace que la regla de alerta se ejecute continuamente, lo que podría afectar la disponibilidad del sistema si la regla de alerta ejecuta consultas complejas. • https://discuss.elastic.co/t/kibana-8-14-0-security-update-esa-2024-15/360887 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23446 – Kibana Broken Access Control issue
https://notcve.org/view.php?id=CVE-2024-23446
An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index. Elastic descubrió un problema por el cual la API de búsqueda del motor de detección no respeta la seguridad a nivel de documento (DLS) o la seguridad a nivel de campo (FLS) al consultar los índices .alerts-security.alerts-{space_id}. Los usuarios que estén autorizados a llamar a esta API pueden obtener acceso no autorizado a documentos si sus roles están configurados con DLS o FLS contra el índice antes mencionado. • https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-01/352686 https://www.elastic.co/community/security • CWE-284: Improper Access Control •