Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.7

Kibana lets unprivileged users see Elastic Agent policies

CVE-2024-43707 · published 1 year ago
Summary

Kibana currently allows users who are not authorized to manage Fleet to look at Elastic Agent policies, which can include confidential configuration details. This could let sensitive information be seen by people who shouldn’t have it. Apply the latest Kibana update that fixes the problem and review your user permissions to ensure only the right people can view these policies.

What to do
  • Update elk to version 8.15.0.
  • Update kibana to version 8.15.0.
  • Update elastic kibana to version 8.15.0 or later.
Affected software
Ecosystem VendorProductAffected versions
Bitnami – elk >= 8.0.0, < 8.15.0
Fix: upgrade to 8.15.0
– elastic kibana >= 8.7.0, < 8.15.0
cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*
Bitnami – kibana >= 8.0.0, < 8.15.0
Fix: upgrade to 8.15.0
Original advisory text
Kibana exposure of sensitive information to an unauthorized actor
An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published23 Jan 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-43707 · NVD
CVE-2024-43707 · OSV
BIT-elk-2024-43707 · OSV
Track software like this
Free during beta