Skip to content
OpenAdvisories
High WID-SEC-2024-2068 2 CVEs

Kibana: Mehrere Schwachstellen ermöglichen Codeausführung

Published Sep 5, 2024 · Updated Sep 5, 2024 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um beliebigen Programmcode auszuführen.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 2

  • Critical 9.9
    CVE-2024-37288

    A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document co…

    Elastic Kibana
  • Critical 9.1
    CVE-2024-37285

    Kibana arbitrary code execution via YAML deserialization

    A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privi…

    Elastic Kibana

Revision history

  1. #1

    Initiale Fassung

References