CVE-2022-23709

2022-03-0321:50:17

CWE-264

elastic

www.cve.org

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.7%

JSON

A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modified rules would not be enabled, and a user with this privilege could not modify alerting connectors. This effectively means that Read users could disable existing alerting rules.

CNA Affected

[
  {
    "product": "kibana",
    "vendor": "Elastic",
    "versions": [
      {
        "status": "affected",
        "version": "Versions 7.7.0 through 7.17.0, and 8.0.0"
      }
    ]
  }
]