CVE-2024-37287
Kibana arbitrary code execution via prototype pollution
Summary
Kibana arbitrary code execution via prototype pollution
Original description
The description as published by the source.
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- web discuss.elastic.co