Skip to content
OpenAdvisories
Medium WID-SEC-2025-0179 4 CVEs

Kibana: Mehrere Schwachstellen

Published Jan 22, 2025 · Updated Jan 22, 2025 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Informationen preiszugeben, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu erzeugen.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 4

  • High 7.7
    CVE-2024-43707

    Kibana exposure of sensitive information to an unauthorized actor

    An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respec…

    Elastic Kibana
  • Medium 6.5
    CVE-2024-43708

    An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted pay…

    Elastic Kibana
  • Medium 6.5
    CVE-2024-52972

    Kibana allocation of resources without limits or throttling leads to crash

    An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.

    Elastic Kibana
  • Medium 4.3
    CVE-2024-43710

    Kibana server-side request forgery

    A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON …

    Elastic Kibana

Revision history

  1. #1

    Initiale Fassung

References