CVE-2024-52972

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
Elastic	Kibana	>= 8.0.0, < 8.15.0; >= 7.0.0, < 7.17.23

References

https://discuss.elastic.co/t/kibana-7-17-23-8-15-0-security-updates-esa-2024-32-esa-2024-33/373548Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Jan 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-529736.5An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entr CVE-2024-529746.5An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A succe CVE-2024-529759.0An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log leve CVE-2024-529767.8Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitra CVE-2024-529797.5Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead t CVE-2024-52988.8D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote CVE-2024-529806.5A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class co CVE-2024-529817.5An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection o CVE-2024-529827.8Animate versions 23.0.8, 24.0.5 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code e CVE-2024-529837.8Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary c CVE-2024-529847.8Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arb CVE-2024-529857.8Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arb