CVE-2024-37287
CVSS V2 None
CVSS V3 None
Description
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.
Overview
- CVE ID
- CVE-2024-37287
- Assigner
- elastic
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-08-13T11:33:45.520Z
- Last Modified Date
- 2024-08-13T13:35:02.988Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://discuss.elastic.co/t/kibana-8-14-2-7-17-23-security-update-esa-2024-22/ |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-37287 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37287 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-08-14 13:05:34 | Added to TrackCVE |