CVE-2024-52972

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-52972
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-52972.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-52972
Aliases
Published
2025-01-23T07:15:08.700Z
Modified
2026-03-09T23:55:14.097095Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.

References

Affected packages

Git / github.com/elastic/kibana

Affected ranges

Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
89cafc519e1d6e0e08d8cf5c13eee6886fe6e412
Introduced
57ca5e139a33dd2eed927ce98d8231a1f217cd15
Fixed
8aa0b59da12c996e3048d8875446667ee6e15c7f
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.17.23"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.15.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-52972.json"