| Package | Affected versions | Patched versions |
|---|---|---|
| kibana | ≥ 9.4.0, < 9.4.5 | 9.4.5 |
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free