Deserialization vulnerability in Kibana can lead to arbitrary code execution
CVE-2024-37288

8.8HIGH

Key Information:

Vendor
Elastic
Status
Kibana
Vendor
CVE Published:
9 September 2024

Badges

đź“° News Worthy

Summary

A vulnerability in Kibana has been identified, stemming from a deserialization issue that may allow for arbitrary code execution. This flaw occurs specifically when Kibana attempts to process a maliciously crafted YAML document. Only instances of Kibana that leverage Elastic Security’s integrated AI tools and have seamlessly configured an Amazon Bedrock connector are impacted. Users of these features should exercise caution and apply security updates to mitigate potential risks associated with this vulnerability.

Affected Version(s)

Kibana 8.15.0

News Articles

đź”—CybersecurityNews

Kibana Vulnerabilities Let Attackers Execute Arbitrary Code

Kibana Vulnerabilities, CVE-2024-37288 and CVE-2024-37285, allow attackers to execute arbitrary code through YAML deserialization issues.

5 months ago

References

https://discuss.elastic.co/t/kibana-8-15-1-security-updat...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • đź“°

    First article discovered by CybersecurityNews

  • Vulnerability published

  • Vulnerability Reserved

.