CVE-2022-23711

2022-04-2118:22:58

CWE-200

elastic

www.cve.org

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.3%

JSON

A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the health and performance of your Elasticsearch cluster. Authentication with a vulnerable Kibana instance is not required to view the exposed information. The Elastic Stack monitoring exposure only impacts users that have set any of the optional monitoring.ui.elasticsearch.* settings in order to configure Kibana as a remote UI for Elastic Stack Monitoring. The same vulnerability in Kibana could expose other non-sensitive application-internal information in the page source.

CNA Affected

[
  {
    "product": "kibana",
    "vendor": "Elastic",
    "versions": [
      {
        "status": "affected",
        "version": "Versions 7.2.1 through 7.17.2 & 8.0.0 through 8.1.2"
      }
    ]
  }
]