CVE-2024-43707
Kibana exposure of sensitive information to an unauthorized actor
Résumé
Kibana exposure of sensitive information to an unauthorized actor
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.
Paquets affectés
Bitnami
elk
[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.15.0"}]}]
Bitnami
kibana
[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.15.0"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- web discuss.elastic.co