An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.

According to its self-reported version number, the Kibana application running on the remote host is 7.x prior to 7.17.23 or 8.x prior to 8.15.0. It is, therefore, affected by Multiples Vulnerabilities.

- An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. - An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
114633	Kibana 8.x < 8.15.0 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
114632	Kibana 7.x < 7.17.23 Multiples Denial Of Service	Web App Scanning	Component Vulnerability	Version Based	medium

Detections

Analytics

CVE-2024-52972

medium

Tenable Plugins

medium

medium