CVE-2025-68422
Kibana Improper Authorization
Résumé
Kibana Improper Authorization
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries.
Paquets affectés
Bitnami
elk
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.19.7"},{"introduced":"9.0.0"},{"fixed":"9.1.7"},{"introduced":"9.2.0"},{"fixed":"9.2.1"}]}]
Bitnami
kibana
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.19.7"},{"introduced":"9.0.0"},{"fixed":"9.1.7"},{"introduced":"9.2.0"},{"fixed":"9.2.1"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- web discuss.elastic.co