Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in a space to which they have access.
Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.
An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.
An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.
URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests.
In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors
CVE-2015-1427 is a high-severity vulnerability in Elasticsearch's Groovy scripting engine that allows remote attackers to bypass sandbox protections and execute arbitrary shell commands. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2014-3120 is a high-severity vulnerability in Elasticsearch that allows remote attackers to execute arbitrary MVEL expressions and Java code due to dynamic scripting being enabled. This remote code execution flaw has been exploited in the wild. No specific affected versions or patch information are provided in the input data.
CVE-2019-7609 is a high-severity vulnerability in Kibana's Timelion visualizer that allows arbitrary code execution. This flaw has been exploited in the wild, posing a significant risk to affected systems. No specific affected versions or patch information are provided in the available data.
