{"id":"CVE-2024-37279","summary":"Kibana Broken Access Control issue","details":"A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.","aliases":["BIT-elk-2024-37279","BIT-kibana-2024-37279"],"modified":"2026-08-12T03:51:14.495647004Z","published":"2024-06-13T17:04:41.737Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37279.json","unresolved_ranges":[{"extracted_events":[{"introduced":"8.6.3"},{"last_affected":"8.13.4"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"elastic"},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/kibana-8-14-0-security-update-esa-2024-15/360887"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37279.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37279"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"0"},{"fixed":"8d96bbe3bf5fed931f3119733895458eab75dca9"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"8.6.3"},{"fixed":"8.14.0"}]}}],"versions":["v8.0.0-alpha2","v8.0.0-alpha1","v7.0.0-alpha2","v7.0.0-alpha1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37279.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"0"},{"fixed":"3bc2979d1d65982aee7d13ebd65434c3470dc808"}],"database_specific":{"extracted_events":[{"introduced":"8.6.3"},{"fixed":"8.14.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*"}}],"versions":["deploy@1713161715","deploy@1712566963","deploy@1711952105","deploy@1711370131","deploy@1710741924","deploy@1710146776","deploy@1710137117","deploy@1709533819","deploy@1709532332","deploy@1708927574","deploy@1708322739","deploy@1707717945","deploy@1707113127","deploy@1706508321","deploy@1705903520","deploy@1705306975","deploy@1705298718","deploy@1704693922","deploy@1704089101","deploy@1703484304","deploy@1702903357","deploy@1702879551","deploy@1702367069","deploy@1702284899","deploy@1701687168","deploy@1701160888","deploy@1700491293","deploy@1699865290","deploy@1699260155","deploy@1698657637","deploy@1698046713","deploy@1697564183","deploy@1697232175","test-depl-20231025084603","test-depl-20231013154558","deploy@1697028216","deploy@1696873111","deploy@1696618725","deploy@1696508231","deploy@1696415195","deploy@1696328885","deploy@1695286747","deploy@1694683198","deploy@1694506029","deploy@1694162455","deploy@1694087994","deploy@1693866333","deploy@1693860790","deploy@1693853982","deploy@1693609987","deploy@1693594780","v8.0.0-alpha2","v8.0.0-alpha1","v7.0.0-alpha1","7.0-known-good","v6.0.0-alpha2","v6.0.0-alpha1","v5.0.0-alpha5","v4.2.0-beta1","v4.0.0-beta3","v4.0.0-beta2","v4.0.0-beta1.1","v4.0.0-beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37279.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}]}