{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-01T02:31:18.966","vulnerabilities":[{"cve":{"id":"CVE-2024-37285","sourceIdentifier":"security@elastic.co","published":"2024-11-14T17:15:06.457","lastModified":"2026-06-17T07:38:04.550","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific  Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv  and  Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html  assigned to them.\n\n\n\nThe following Elasticsearch indices permissions are required\n\n  *  write privilege on the system indices .kibana_ingest*\n  *  The allow_restricted_indices flag is set to true\n\n\nAny of the following Kibana privileges are additionally required\n\n  *  Under Fleet the All privilege is granted\n  *  Under Integration the Read or All privilege is granted\n  *  Access to the fleet-setup privilege is gained through the Fleet Server’s service account token"},{"lang":"es","value":"Un problema de deserialización en Kibana puede provocar la ejecución de código arbitrario cuando Kibana intenta analizar un documento YAML que contiene un payload manipulado. Un ataque exitoso requiere que un usuario malintencionado tenga una combinación de privilegios específicos de índices de Elasticsearch https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv y privilegios de Kibana https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html asignados a ellos. Se requieren los siguientes permisos de índices de Elasticsearch * privilegio de escritura en los índices del sistema .kibana_ingest* * El indicador allow_restricted_indices está configurado en verdadero Cualquiera de los siguientes privilegios de Kibana también se requiere * En Fleet, se otorga el privilegio All * En Integration, se otorga el privilegio Read o All * El acceso al privilegio de configuración de la flota se obtiene a través del token de cuenta de servicio del servidor Fleet"}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Kibana","defaultStatus":"unaffected","versions":[{"version":"8.10.0","lessThanOrEqual":"8.15.0","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"elastic","product":"kibana","defaultStatus":"unknown","cpes":["cpe:2.3:a:elastic:kibana:-:*:*:*:*:*:*:*"],"versions":[{"version":"8.10.0","lessThanOrEqual":"8.15.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-11-14T18:46:46.588026Z","id":"CVE-2024-37285","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.10.0","versionEndIncluding":"8.15.0","matchCriteriaId":"A43056B3-82DB-47C7-83C9-79C1E628221C"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/kibana-8-15-1-security-update-esa-2024-27-esa-2024-28/366119","source":"security@elastic.co","tags":["Patch","Vendor Advisory"]}]}}]}