CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46671 – Kibana Insertion of Sensitive Information into Log File
https://notcve.org/view.php?id=CVE-2023-46671
An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users. The issue occurs infrequently, only if an error is returned from an Elasticsearch cluster, in cases where there is user interaction and an unhealthy cluster (for example, when returning circuit breaker or no shard exceptions). Elastic descubrió un problema por el cual se puede registrar información confidencial en los registros de Kibana en caso de un error. • https://discuss.elastic.co/t/8-11-1-7-17-15-security-update-esa-2023-25/347149 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31414
https://notcve.org/view.php?id=CVE-2023-31414
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process. • https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330 https://www.elastic.co/community/security • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-38779
https://notcve.org/view.php?id=CVE-2022-38779
An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. • https://discuss.elastic.co/t/kibana-7-17-9-and-8-6-2-security-update/325782 https://www.elastic.co/community/security • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-38778
https://notcve.org/view.php?id=CVE-2022-38778
A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process. • https://discuss.elastic.co/t/elastic-7-17-9-8-5-0-and-8-6-1-security-update/324661 https://www.elastic.co/community/security • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23713
https://notcve.org/view.php?id=CVE-2022-23713
A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser. Se ha detectado una vulnerabilidad de tipo cross-site-scripting (XSS) en la integración de Vega Charts Kibana, que podría permitir la ejecución de JavaScript arbitrario en el navegador de la víctima • https://discuss.elastic.co/t/elastic-8-3-1-8-3-0-and-7-17-5-security-update/308613 https://www.elastic.co/community/security • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •