CyberRota Analysis
AI-GeneratedKibana is vulnerable due to a missing authorization flaw that allows authenticated users with minimal Elasticsearch privileges to bypass feature authorization and space access controls. This can lead to unauthorized disclosure of sensitive Fleet deployment metadata from the default Kibana space. Organizations using Kibana, especially those with sensitive data and multiple user roles, should prioritize addressing this vulnerability to mitigate potential information leaks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.
Related CVEs
Other vulnerabilities affecting the same vendor(s)