Threat Investigation
Request a demo

CVE-2024-52973

Medium

Description

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana.

SeverityMedium
CVSS6.5
Exploit probability—
ProductElastic Kibana
PublishedJan 21, 2025
First seenJan 21, 2025
Weakness typeCWE-770Allocation of resources without limits

How to fix

Update
  • elastic kibana7.17.23, 8.14.2 or later

Affected products

ProductAffected versionsFixed in
elastic kibanav < 7.17.23, 8.0.0 ≤ v < 8.14.27.17.23, 8.14.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.