UpHeron
All vulnerabilities

Servers and applications

CVE-2024-52972

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.

Severity
Medium 6.5
Published
23 Jan 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.17.23, 8.15.0
Sources
NVD

Affected software

SoftwareAffected versions
KibanaServers and applications · cpe:a:elastic:kibana
  • Every version before 7.17.23
  • From 8.0.0 before 8.15.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-52972
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-52972