Denial Of Service

2024-07-0407:37:39

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

kibana

run_soon api

view-only users

alerting rules

system availability.

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

7.2

Confidence

High

JSON

kibana is vulnerable to Denial Of Service. The vulnerability is due to the run_soon API allowing view-only users to execute alerting rules continuously, potentially impacting system availability if the alerting rules involve complex queries. An attacker can exploit this to degrade system performance.