PT-2023-30153 · Elastic · Kibana

Published 2023-12-13 · Updated 2023-12-18 · CVE-2023-46671

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kibana versions prior to 8.11.1

Description An issue was discovered whereby sensitive information may be recorded in Kibana logs in the event of an error. The error message recorded in the log may contain account credentials for the kibana system user, API Keys, and credentials of Kibana end-users. The issue occurs infrequently, only if an error is returned from an Elasticsearch cluster, in cases where there is user interaction and an unhealthy cluster, such as when returning circuit breaker or no shard exceptions.

Recommendations For versions prior to 8.11.1, update to Kibana 8.11.1 to resolve the issue. As a temporary workaround, consider restricting access to Kibana logs to minimize the risk of sensitive information exposure.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2023-46671

Affected Products

Kibana

References · 7

• https://osv.dev/vulnerability/CVE-2023-46671 · Vendor Advisory
• https://discuss.elastic.co/t/8-11-1-7-17-15-security-update-esa-2023-25/347149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46671 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46671 · Note
• https://t.me/cvenotify/63948 · Telegram Post
• https://twitter.com/CVEnew/status/1734834151486857701 · Twitter Post
• https://t.me/cvenotify/63449 · Telegram Post