# Kibana 7.17.23 and 8.15.1 Security Update (ESA-2024-36)

**URL:** <https://discuss.elastic.co/t/kibana-7-17-23-and-8-15-1-security-update-esa-2024-36/376923>\
**Category:** Security Announcements\
**Created:** [April 8, 2025, 3:59pm UTC](https://discuss.elastic.co/t/kibana-7-17-23-and-8-15-1-security-update-esa-2024-36/376923 "2025-04-08T15:59:01Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Bryan\_Garcia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_garcia/32/148179_2.png) [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\
**Post date:** [April 8, 2025, 3:59pm UTC](https://discuss.elastic.co/t/kibana-7-17-23-and-8-15-1-security-update-esa-2024-36/376923/1 "2025-04-08T15:59:01Z")

</div>

**Kibana Uncontrolled Resource Consumption vulnerability (ESA-2024-36)**

An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash.

A successful attack requires a malicious user to have read permissions for Observability assigned to them.

**Affected Versions:**  
Kibana versions 7.17.0 to 7.17.22 and versions 8.0.0 to 8.15.0.

**Solutions and Mitigations:**  
Users should upgrade to version 8.15.1 or higher.

**Severity:** CVSS v3.1: 6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

**CVE ID:** CVE-2024-52974

---

_[View the full topic](https://discuss.elastic.co/t/kibana-7-17-23-and-8-15-1-security-update-esa-2024-36/376923)._