All vulnerabilities

Servers and applications

CVE-2024-37288

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html  and have configured an Amazon Bedrock connector…

Severity
High 8.8
Published
9 Sept 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
KibanaServers and applications · cpe:a:elastic:kibana
  • Version 8.15.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-37288
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-37288