CVE-2024-52974

Опубликовано: 08 апр. 2025

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash.

A successful attack requires a malicious user to have read permissions for Observability assigned to them.

Ссылки

https://discuss.elastic.co/t/kibana-7-17-23-and-8-15-1-security-update-esa-2024-36/376923
Issue Tracking
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*

Версия от 7.17.0 (включая) до 7.17.23 (исключая)

cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*

Версия от 8.0.0 (включая) до 8.15.1 (исключая)

EPSS

Процентиль: 52%

0.00288

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-400

Связанные уязвимости

CVE-2024-52974

CVSS3: 6.5

debian

10 месяцев назад

An issue has been identified where a specially crafted request sent to ...

GHSA-95rc-q9jr-6jhg

CVSS3: 6.5

github

10 месяцев назад

An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.

EPSS

Процентиль: 52%

0.00288

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-400