PT-2022-16219 · Elastic · Kibana

Published 2022-03-03 · Updated 2022-03-16 · CVE-2022-23709

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description A flaw was discovered in Kibana where users with Read access to the Uptime feature could modify alerting rules, allowing them to create new rules or overwrite existing ones. However, any new or modified rules would not be enabled, and these users could not modify alerting connectors. This means Read users could effectively disable existing alerting rules.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

CWE-264

Related Identifiers

CVE-2022-23709

Affected Products

Kibana

References · 4

• https://osv.dev/vulnerability/CVE-2022-23709 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23709 · Security Note
• https://discuss.elastic.co/t/elastic-stack-7-17-1-security-update/298447 · Vendor Advisory
• https://t.me/cibsecurity/38387 · Telegram Post