A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the health and performance of your Elasticsearch cluster. Authentication with a vulnerable Kibana instance is not required to view the exposed information. The Elastic Stack monitoring exposure only impacts users that have set any of the optional monitoring.ui.elasticsearch.* settings in order to configure Kibana as a remote UI for Elastic Stack Monitoring. The same vulnerability in Kibana could expose other non-sensitive application-internal information in the page source.

According to its self-reported version number, the Kibana application running on the remote host is 7.2.1 prior to 7.17.2 or 8.0.0 prior to 8.1.3. It is, therefore, affected by :

- A Sensitive Information Exposure related to Elastic Stack monitoring in the Kibana page source (CVE-2022-23711)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
113530	Kibana 8.0.0 < 8.1.3 Sensitive Information Exposure	Web App Scanning	Component Vulnerability	Version Based	medium
113529	Kibana 7.2.1 < 7.17.3 Sensitive Information Exposure	Web App Scanning	Component Vulnerability	Version Based	medium

Detections

Analytics

CVE-2022-23711

medium

Tenable Plugins

medium

medium