Description
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Kibana | 7.7.0, 8.0.0 – < 7.17.23, 8.14.2 | 7.17.23, 8.14.2 |
Advisories 2
- ICSA-24-319-13 Rockwell Automation Verve Reporting (Update A) CISA ICS & IT advisories · Nov 18, 2024
- WID-SEC-2024-1768 Kibana: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Aug 5, 2024