{"id":"CVE-2024-43706","summary":"Kibana Improper Authorization","details":"Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.","aliases":["BIT-elk-2024-43706","BIT-kibana-2024-43706"],"modified":"2026-08-12T03:51:38.010400895Z","published":"2025-06-10T16:59:54.945Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"8.12.0"},{"fixed":"8.12.1"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"elastic","cwe_ids":["CWE-285"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43706.json"},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-21/379064"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43706.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43706"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"0"},{"last_affected":"1665f706fd9354802c02146c1e6b5c0fbcddfbc9"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"8.12.0"}]}}],"versions":["v8.12.0","v8.0.0-alpha2","v8.0.0-alpha1","v7.0.0-alpha2","v7.0.0-alpha1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43706.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"0"},{"last_affected":"e9092c0a17923f4ed984456b8a5db619b0a794b3"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"8.12.0"}]}}],"versions":["v8.12.0","deploy@1701687168","deploy@1701160888","deploy@1700491293","deploy@1699865290","deploy@1699260155","deploy@1698657637","deploy@1698046713","deploy@1697564183","deploy@1697232175","test-depl-20231025084603","test-depl-20231013154558","deploy@1697028216","deploy@1696873111","deploy@1696618725","deploy@1696508231","deploy@1696415195","deploy@1696328885","deploy@1695286747","deploy@1694683198","deploy@1694506029","deploy@1694162455","deploy@1694087994","deploy@1693866333","deploy@1693860790","deploy@1693853982","deploy@1693609987","deploy@1693594780","v8.0.0-alpha2","v8.0.0-alpha1","v7.0.0-alpha1","7.0-known-good","v6.0.0-alpha2","v6.0.0-alpha1","v5.0.0-alpha5","v4.2.0-beta1","v4.0.0-beta3","v4.0.0-beta2","v4.0.0-beta1.1","v4.0.0-beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43706.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"}]}