Kibana Insertion of Sensitive Information into Log File

CVE-2023-31422

What is CVE-2023-31422?

A vulnerability has been identified in Elastic Kibana, where sensitive user information may be unintentionally recorded in logs during error events. This issue specifically affects Kibana version 8.10.0, particularly when utilizing JSON logging and certain pattern configurations that incorporate the %meta pattern. The logged error objects may include highly sensitive data such as authentication credentials, cookies, authorization headers, and query parameters, potentially revealing account details for users such as kibana_system and kibana-metricbeat. To mitigate this risk, users are advised to upgrade to Kibana 8.10.1, which addresses this logging issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References