An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users, Elastic Security package policy objects which can contain private keys, bearer token, and sessions of 3rd-party integrations and finally Authorization headers, client secrets, local file paths, and stack traces. The issue may occur in any Kibana instance running an affected version that could potentially receive an unexpected error when communicating to Elasticsearch causing it to include sensitive data into Kibana error logs. It could also occur under specific circumstances when debug level logging is enabled in Kibana. Note: It was found that the fix for ESA-2023-25 in Kibana 8.11.1 for a similar issue was incomplete.

According to its self-reported version number, the Kibana application running on the remote host is 7.13.x prior to 7.17.16 or 8.x prior to 8.11.1. It is, therefore, affected by an issue that can log sensitive information in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Elastic Kibana instance on the remote host is 7.13.0 prior to 7.17.16 or 8.0 prior to 8.11.1. It is, therefore, affected by an information disclosure vulnerability. In the event of an infrequent error returned from an Elasticsearch cluster, in cases where there is user interaction and an unhealthy cluster, sensitive information may be recorded in Kibana logs within the error message. The error message may contain account credentials for the kibana_system 67 user, API Keys, and credentials of Kibana end-users. Note: It was found that the fix for ESA-2023-25 in Kibana 8.11.1 for a similar issue was incomplete. 

Note that Nessus has not tested for the issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114642	Kibana 7.13.x < 7.17.16 Insertion of Sensitive Information into Log File	Web App Scanning	Component Vulnerability	medium
114641	Kibana 8.x < 8.11.2 Insertion of Sensitive Information into Log File	Web App Scanning	Component Vulnerability	medium
187123	Elastic Kibana 7.13.0 < 7.17.16, 8.0 < 8.11.2 Information Disclosure (ESA-2023-27)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2023-46675

medium

Tenable Plugins

medium

medium

medium