CVE-2024-37279

Kibana Broken Access Control issue

Summary

Original description

The description as published by the source.

A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami elk

[{"type":"SEMVER","events":[{"introduced":"8.6.3"},{"fixed":"8.14.0"}]}]

Bitnami kibana

[{"type":"SEMVER","events":[{"introduced":"8.6.3"},{"fixed":"8.14.0"}]}]

References

advisory nvd.nist.gov
advisory github.com
web discuss.elastic.co