BIT-elk-2024-43707

vendorUSosv

Kibana exposure of sensitive information to an unauthorized actor

view advisory published 2025-01-27Licence: per source

An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-43707US	medium6.5	0.43% (37th)	—	2025-01-23
An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive informa…

references

External citations — patches, advisories, analysis.

https://discuss.elastic.co/t/kibana-8-15-0-security-update-esa-2024-29-esa-2024-30/373521ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2024-43707WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan