Unauthorized Access to Documents via DLS/FLS in .alerts-security.alerts-{space_id} Indices
CVE-2024-23446

6.5MEDIUM

Key Information:

Vendor
Elastic
Status
Kibana
Vendor
CVE Published:
7 February 2024

Summary

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.

Affected Version(s)

Kibana 8.12.0 < 8.12.1

References

https://discuss.elastic.co/t/kibana-8-12-1-security-updat...
https://www.elastic.co/community/security

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.