CVE-2024-37287 — Code Injection in Kibana

CWE-94 — Code InjectionCWE-1321 — Prototype Pollution3 documents3 sources
Severity
7.2HIGHNVD
CNA9.1
EPSS
0.9%
top 25.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Kibana
Timeline
PublishedAug 13

Description

A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5elastic/kibana7.7.0, 8.0.0 — 7.17.23, 8.14.2
▶NVDelastic/kibana7.7.0 — 7.17.23+1

🔴Vulnerability Details

2
GHSA
GHSA-7fgx-pmw9-49h5: A flaw allowing arbitrary code execution was discovered in Kibana↗2024-08-13
▶
CVEList
Kibana arbitrary code execution via prototype pollution↗2024-08-13
▶
CVE-2024-37287 — Code Injection in Elastic Kibana | cvebase