Lucene search

ElasticCVE-2024-37288

HistorySep 09, 2024 - 9:15 a.m.

CVE-2024-37288

2024-09-0909:15:02

CWE-502

elastic

web.nvd.nist.gov

kibana deserialization issue

arbitrary code execution

yaml payload

elastic security

ai tools

amazon bedrock connector

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.7

Confidence

Low

EPSS

0.001

Percentile

20.0%

JSON

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html .

Affected configurations

Nvd

Node

elastickibanaMatch8.15.0

VendorProductVersionCPE
elastickibana8.15.0cpe:2.3:a:elastic:kibana:8.15.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
elastic	kibana	8.15.0	cpe:2.3:a:elastic:kibana:8.15.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Kibana",
    "vendor": "Elastic",
    "versions": [
      {
        "status": "affected",
        "version": "8.15.0",
        "versionType": "semver"
      }
    ]
  }
]

References

discuss.elastic.co/t/kibana-8-15-1-security-update-esa-2024-27-esa-2024-28/366119

Social References

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.7

Confidence

Low

EPSS

0.001

Percentile

20.0%

JSON

Related for CVE-2024-37288