Information Exposure Through Log Files Affecting kibana package, versions >=8.0.0 <8.11.1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-KIBANA-6084027
- published 24 Nov 2023
- disclosed 14 Nov 2023
- credit Unknown
Introduced: 14 Nov 2023
CVE-2023-46671 Open this link in a new tabHow to fix?
Upgrade kibana to version 8.11.1 or higher.
Overview
kibana is an open source (Apache Licensed), browser-based analytics and search dashboard for Elasticsearch.
Affected versions of this package are vulnerable to Information Exposure Through Log Files in the event of an error. The error message recorded in the log may contain account credentials for the kibana_system user, API Keys, and credentials of end-users.
Note:
The issue occurs infrequently, only if an error is returned from a cluster and if there is an unhealthy cluster (for example, when returning circuit breaker or no shard exceptions).