CVE-2024-43710

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-43710
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43710.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-43710
Aliases
Published
2025-01-23T06:15:27.550Z
Modified
2026-03-12T08:30:16.357879Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.

References

Affected packages

Git / github.com/elastic/kibana

Affected ranges

Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
05f12599523732051b84dde0b8d5610e0db2b06d
Fixed
8aa0b59da12c996e3048d8875446667ee6e15c7f
Database specific 
{
    "versions": [
        {
            "introduced": "8.7.0"
        },
        {
            "fixed": "8.15.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43710.json"