CVE-2024-37287
- Source
- https://cve.org/CVERecord?id=CVE-2024-37287
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37287.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-37287
- Published
- 2024-08-13T11:33:45.520Z
- Modified
- 2026-07-22T03:35:12.398016Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- Kibana arbitrary code execution via prototype pollution
- Details
-
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.
- Database specific
{ "unresolved_ranges": [ { "extracted_events": [ { "introduced": "7.7.0, 8.0.0" }, { "fixed": "7.17.23, 8.14.2" } ], "source": "AFFECTED_FIELD" } ], "cwe_ids": [ "CWE-94" ], "cna_assigner": "elastic", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37287.json" }- References
Affected packages
Git / github.com/elastic/elasticsearch
Database specific
vanir_signatures_modified
"2026-07-22T03:35:12Z"
vanir_signatures
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 208.0,
"function_hash": "157760494053827667837118573639039555464"
},
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/2afe7caceec8a26ff53817e5ed88235e90592a1b",
"id": "CVE-2024-37287-1aaca071",
"target": {
"function": "HostMetadata",
"file": "x-pack/plugin/profiling/src/main/java/org/elasticsearch/xpack/profiling/action/HostMetadata.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"193896757828941243145844563929241691184",
"39740713853991130670304049919892173951",
"254635273340976470161436700641393198580",
"22813550668332820745376567044791137889",
"305120663579770874905624609675087589553",
"317751899246233353377722397317280756073"
]
},
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/2afe7caceec8a26ff53817e5ed88235e90592a1b",
"id": "CVE-2024-37287-3ed4fce0",
"target": {
"file": "x-pack/plugin/profiling/src/main/java/org/elasticsearch/xpack/profiling/action/HostMetadata.java"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 935.0,
"function_hash": "69844453905830246677820397096534298013"
},
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/61d76462eecaf09ada684d1b5d319b5ff6865a83",
"id": "CVE-2024-37287-3fa86dc6",
"target": {
"function": "test600Interrupt",
"file": "qa/os/src/test/java/org/elasticsearch/packaging/test/DockerTests.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"62207153923184484221203502965514732534",
"130998578839398306062437037584016935344",
"132774376564083153220369201262182294846"
]
},
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/2afe7caceec8a26ff53817e5ed88235e90592a1b",
"id": "CVE-2024-37287-4c266fcc",
"target": {
"file": "x-pack/plugin/profiling/src/test/java/org/elasticsearch/xpack/profiling/action/CO2CalculatorTests.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"268439700297186282373755313812072452487",
"26797522030344409565822344236984547088",
"49674375891833826585064844018322645796",
"241861009769944274883436754269135918658",
"110241150124042836880806124194125742521",
"4974205076996931494879974579405987532"
]
},
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/61d76462eecaf09ada684d1b5d319b5ff6865a83",
"id": "CVE-2024-37287-bda6ba2f",
"target": {
"file": "qa/os/src/test/java/org/elasticsearch/packaging/test/DockerTests.java"
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37287.json"