Kibana Flaw Allows View-Only Users to Continuously Run Alerting Rules, Affecting System Availability

CVE-2024-37279

4.3MEDIUM

Key Information

Vendor: Elastic
Status: Kibana
Vendor: CVE Published:; 13 June 2024

Summary

A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.

Affected Version(s)

Kibana <= 8.13.4

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Jun 13, 2024
Vulnerability Reserved.
Jun 5, 2024

Collectors

NVD DatabaseMitre Database