CyberRota Analysis
AI-GeneratedThe Kibana machine learning feature is vulnerable due to incorrect authorization, allowing authenticated users to access and utilize machine learning functionalities beyond their permitted scope. This can lead to unauthorized consumption of cluster resources, potentially impacting system performance and availability. Organizations using Kibana, especially those with sensitive data or resource constraints, should prioritize addressing this vulnerability to mitigate the risk of resource exhaustion.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user could invoke machine learning functionality beyond their authorization scope, consuming cluster resources they should not be able to reach.