CVE-2024-43710: 
Kibana vulnerability analysis and mitigation

A server-side request forgery (SSRF) vulnerability was identified in Kibana (CVE-2024-43710) where the /api/fleet/health_check API could be used to send requests to internal endpoints. The vulnerability affects Kibana versions from 8.7.0 up to 8.15.0, and can be exploited by users with read access to Fleet. Due to the nature of the underlying request, only endpoints available over HTTPS that return JSON could be accessed (Elastic Discussion).

The vulnerability has been assigned a CVSSv3.1 score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and specifically affects the /api/fleet/health_check API endpoint (NVD, Elastic Discussion).

The vulnerability allows attackers to send requests to internal endpoints, though the impact is limited as only HTTPS endpoints returning JSON responses can be accessed. This could potentially lead to unauthorized access to internal services or information disclosure (Security Online).

The vulnerability requires an attacker to have read access to Fleet functionality in Kibana. The attack can be carried out remotely with low attack complexity and does not require user interaction (Elastic Discussion).

The vulnerability has been fixed in Kibana version 8.15.0. Users are strongly encouraged to upgrade to this version to address the security issue (Security Online, Elastic Discussion).