Deserialization vulnerability in Kibana can lead to arbitrary code execution

CVE-2024-37288

What is CVE-2024-37288?

A vulnerability in Kibana has been identified, stemming from a deserialization issue that may allow for arbitrary code execution. This flaw occurs specifically when Kibana attempts to process a maliciously crafted YAML document. Only instances of Kibana that leverage Elastic Security’s integrated AI tools and have seamlessly configured an Amazon Bedrock connector are impacted. Users of these features should exercise caution and apply security updates to mitigate potential risks associated with this vulnerability.

News Articles

CybersecurityNews

CVE-2024-37285CVE-2024-37288

Kibana Vulnerabilities Let Attackers Execute Arbitrary Code

Kibana Vulnerabilities, CVE-2024-37288 and CVE-2024-37285, allow attackers to execute arbitrary code through YAML deserialization issues.

References