CVE-2025-68386
Kibana Improper Authorization
概要
Kibana Improper Authorization
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.
影響パッケージ
Bitnami
elk
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.19.8"},{"introduced":"9.0.0"},{"fixed":"9.1.8"},{"introduced":"9.2.0"},{"fixed":"9.2.2"}]}]
Bitnami
kibana
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.19.8"},{"introduced":"9.0.0"},{"fixed":"9.1.8"},{"introduced":"9.2.0"},{"fixed":"9.2.2"}]}]
参照URL
- advisory discuss.elastic.co
- web nvd.nist.gov