Unrated severityNVD Advisory· Published Jan 23, 2025· Updated Jan 23, 2025
Kibana server-side request forgery
CVE-2024-43710
Description
A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.
Affected products
3- osv-coords2 versions
>= 8.7.0, < 8.15.0+ 1 more
- (no CPE)range: >= 8.7.0, < 8.15.0
- (no CPE)range: >= 8.7.0, < 8.15.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.