Kibana flaws allow access checks to be bypassed and data exposed
Logged-in users of this company log tool can peek at other teams' records.
Summary
Kibana's Machine Learning, Observability onboarding, Fleet and connector features let logged-in users see information or delete resources they are not allowed to. Kibana users and administrators who use these features are affected.
Affected when
- Authenticated user with Machine Learning read access in one Kibana space
- Authenticated user with privileges to onboard Observability data
- Elasticsearch credentials embedded in the Elasticsearch host URLs in the Kibana configuration
- Low-privileged user with Fleet agent policies write access, and an administrator who interacts with the Fleet interface
- Authenticated user with read access to connectors in one Kibana space
What to do
Check the Elastic advisory for the fixed version. If the Kibana you run is 8.19.23 or older, 9.4.8 or older, or 9.5.5 or older, it is affected: update to a newer version and read the advisory.
Products and platforms
CVE IDs
Sources
Times
First published
First seen