CVE-2024-43707 — Sensitive Information Exposure in Kibana

CWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
6.5MEDIUMNVD
CNA7.7
EPSS
0.8%
top 26.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Kibana
Timeline
PublishedJan 23

Description

An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5elastic/kibana8.0.0 — 8.15.0
▶NVDelastic/kibana8.7.0 — 8.15.0

Patches

Patch: discuss.elastic.co ↗

🔴Vulnerability Details

2
CVEList
Kibana exposure of sensitive information to an unauthorized actor↗2025-01-23
▶
GHSA
GHSA-54qw-wcc8-qjp6: An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information↗2025-01-23
▶
CVE-2024-43707 — Sensitive Information Exposure | cvebase