WARNING: KIBANA VULNERABILITIES (CVE-2024-43707 & CVE-2024-43710), PATCH IMMEDIATELY!

CVE-2024-43707: Kibana Exposure of Sensitive Information (High Severity)

A vulnerability in Kibana allows unauthorized actors to view Elastic Agent policies, potentially exposing sensitive information. The exact nature of the exposed data depends on the enabled integrations and their versions, but it could include important details.

CVE-2024-43710: Kibana Server-Side Request Forgery (Medium Severity)

Kibana’s /api/fleet/health_check API revealed a server-side request forgery vulnerability. The flaw allows users with read access to Fleet to send crafted requests to internal endpoints. Only endpoints available over HTTPS that return JSON could be accessed.