Summary
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Kibana ausnutzen, um beliebigen Programmcode auszuführen.
Product
Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.
Vulnerabilities 1
-
Critical 9.1
Kibana arbitrary code execution via prototype pollution
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary c…
Revision history
-
#1
Initiale Fassung
References
-
Kibana Security Update vom 2024-08-05
https://discuss.elastic.co/t/kibana-8-14-2-7-17-23-security-update-esa-2024-22/364424