CVE-2024-23446

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-01/352686	Vendor Advisory
https://www.elastic.co/community/security	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*

History

14 Feb 2024, 20:10

Type	Values Removed	Values Added
References	~~() https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-01/352686 -~~	() https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-01/352686 - Vendor Advisory
References	~~() https://www.elastic.co/community/security -~~	() https://www.elastic.co/community/security - Vendor Advisory
CWE		NVD-CWE-Other
CPE		cpe:2.3:a:elastic:kibana::::::::
First Time		Elastic Elastic kibana

07 Feb 2024, 13:41

Type	Values Removed	Values Added
Summary		(es) Elastic descubrió un problema por el cual la API de búsqueda del motor de detección no respeta la seguridad a nivel de documento (DLS) o la seguridad a nivel de campo (FLS) al consultar los índices .alerts-security.alerts-{space_id}. Los usuarios que estén autorizados a llamar a esta API pueden obtener acceso no autorizado a documentos si sus roles están configurados con DLS o FLS contra el índice antes mencionado.

07 Feb 2024, 04:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-07 04:15

Updated : 2024-02-14 20:10

NVD link : CVE-2024-23446

Mitre link : CVE-2024-23446

CVE.ORG link : CVE-2024-23446

JSON object : View

Products Affected

elastic

kibana

CWE

NVD-CWE-Other CWE-284

Improper Access Control

{"id": "CVE-2024-23446", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "bressers@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-02-07T04:15:07.470", "references": [{"url": "https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-01/352686", "tags": ["Vendor Advisory"], "source": "bressers@elastic.co"}, {"url": "https://www.elastic.co/community/security", "tags": ["Vendor Advisory"], "source": "bressers@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "bressers@elastic.co", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index."}, {"lang": "es", "value": "Elastic descubri\u00f3 un problema por el cual la API de b\u00fasqueda del motor de detecci\u00f3n no respeta la seguridad a nivel de documento (DLS) o la seguridad a nivel de campo (FLS) al consultar los \u00edndices .alerts-security.alerts-{space_id}. Los usuarios que est\u00e9n autorizados a llamar a esta API pueden obtener acceso no autorizado a documentos si sus roles est\u00e1n configurados con DLS o FLS contra el \u00edndice antes mencionado."}], "lastModified": "2024-02-14T20:10:24.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1742708-C04A-4A6D-838E-93E29B7EF104", "versionEndExcluding": "8.12.1", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "bressers@elastic.co"}