CVE-2024-43707CWE-200

Kibana exposure of sensitive information to an unauthorized actor

High · published January 23, 2025

CVSS v3.1
7.7
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00425 · 35.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-01-23T06:08Z
EPSS history
Timeline
  • 23 JAN 06:08Z
    Kibana exposure of sensitive information to an unauthorized actor
    cvelistv5