Unauthorized Access to Documents via DLS/FLS in .alerts-security.alerts-{space_id} Indices
CVE-2024-23446

6.5MEDIUM

Key Information:

Vendor

Elastic
Status
Kibana
Vendor
CVE Published:
7 February 2024

What is CVE-2024-23446?

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Kibana 8.12.0 < 8.12.1

References

https://discuss.elastic.co/t/kibana-8-12-1-security-updat...
https://www.elastic.co/community/security

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.