Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param `days`. The vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.

According to its self-reported version number, the Kibana application running on the remote host is 8.15.x prior to 8.15.1. It is, therefore, affected by Multiples Vulnerabilities.

- A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. - View-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web
    dashboard can suffer from denial of service by a crafted malicious url query param `days`. The
    vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web
    dashboard. The value is used directly without any checks to create a string slice. If a very large value
    is provided, the backend server ends up using a significant amount of memory and causing it to crash.
    Version 1.8.0 fixes this issue. (CVE-2023-37279)

ID	Name	Product	Family	Severity
114636	Kibana 8.15.x < 8.15.1 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	high
420284	SCA: security update for github.com/contribsys/faktory (GHSA-x4hh-vjm7-g2jv)	Tenable Cloud Security	SCA Checks	high
420284	SCA: security update for github.com/contribsys/faktory (GHSA-x4hh-vjm7-g2jv)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2023-37279

high

Tenable Plugins

high

high

high