CVE-2024-43707

published 2025-01-23

CVE-2024-43707: An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of…

Priority P3 33 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
elastic	kibana	>= 8.0.0 < 8.15.0	8.15.0
elastic	kibana	>= 8.7.0 < 8.15.0	8.15.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200