CVE-2024-43707: Kibana Patches High Severity Vulnerability Exposing Sensitive Information

Kibana, the popular open-source data visualization and exploration tool, has released a security update addressing two vulnerabilities, including one high severity flaw. The update, version 8.15.0, is available now and all users are strongly encouraged to upgrade their installations immediately.

The most critical vulnerability, identified as CVE-2024-43707, could allow unauthorized users to access sensitive information stored within Elastic Agent policies. This information could include confidential data related to various integrations and configurations.

“An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions,” reads the security update.

This vulnerability has a CVSSv3.1 score of 7.7, indicating a high severity risk. It affects all Kibana versions from 8.0.0 up to 8.15.0.

The second vulnerability, CVE-2024-43710, is a server-side request forgery (SSRF) flaw that could allow attackers to send requests to internal endpoints via the /api/fleet/health_check API.

“A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints,” the update explains.

This vulnerability has a CVSSv3.1 score of 4.3 (Medium) and affects Kibana versions from 8.7.0 up to 8.15.0.

To address these vulnerabilities, Kibana has released version 8.15.0, which includes the necessary security patches. Users should upgrade to this version as soon as possible to ensure their systems are protected.

Related Posts:

• CVE-2024-37287 (CVSS 9.9): Urgent Kibana Patch for Severe Security Vulnerability
• Critical Kibana Flaws (CVE-2024-37288, CVE-2024-37285) Expose Systems to Arbitrary Code Execution