CVE-2024-37279: 
Kibana vulnerability analysis and mitigation

A security vulnerability was identified in Kibana (CVE-2024-37279) that affects versions 8.6.3 through 8.13.4. The flaw allows view-only users of alerting functionality to exploit the run_soon API, enabling them to make alerting rules run continuously (Elastic Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. This indicates that the vulnerability requires network access and low privileges to exploit, with no user interaction needed, and primarily impacts system availability (NVD).

When exploited, this vulnerability can affect system availability, particularly if the alerting rule executes complex queries. The continuous execution of alerting rules could potentially lead to system resource consumption and degraded performance (Elastic Advisory).

The vulnerability can be exploited by users with view-only access to the alerting functionality, requiring only low privileges. The attack vector is network-accessible, making it possible to execute remotely (NVD).

The vulnerability has been patched in Kibana version 8.14.0. Users are advised to upgrade to this version to mitigate the security risk (Elastic Advisory).