CVE-2022-23709: elastic kibana
Vulnerability summary
CVE-2022-23709 is a medium (CVSS 4.3) vulnerability in elastic kibana. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45.3% of scored vulnerabilities.
Timeline
- 03-03-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modified rules would not be enabled, and a user with this privilege could not modify alerting connectors. This effectively means that Read users could disable existing alerting rules.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.55%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
0.00 pp
From 0.55% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Elastic1 product
- kibanaVersions 7.7.0 through 7.17.0, and 8.0.0 | ≥ 7.7.0, < 7.17.1 | 8.0.0
1 vendor · 1 product