PT-2023-30153 · Elastic · Kibana

Publicado 2023-12-13 · Atualizado 2023-12-18 · CVE-2023-46671

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kibana versions prior to 8.11.1

Description An issue was discovered whereby sensitive information may be recorded in Kibana logs in the event of an error. The error message recorded in the log may contain account credentials for the kibana system user, API Keys, and credentials of Kibana end-users. The issue occurs infrequently, only if an error is returned from an Elasticsearch cluster, in cases where there is user interaction and an unhealthy cluster, such as when returning circuit breaker or no shard exceptions.

Recommendations For versions prior to 8.11.1, update to Kibana 8.11.1 to resolve the issue. As a temporary workaround, consider restricting access to Kibana logs to minimize the risk of sensitive information exposure.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2023-46671

Produtos afetados

Kibana

Referências · 7

• https://osv.dev/vulnerability/CVE-2023-46671 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46671 · Nota
• https://discuss.elastic.co/t/8-11-1-7-17-15-security-update-esa-2023-25/347149 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-46671 · Nota de Segurança
• https://t.me/cvenotify/63948 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1734834151486857701 · Publicação no Twitter
• https://t.me/cvenotify/63449 · Publicação no Telegram