What is the vulnerability ID for the Kibana Insertion of Sensitive Information into Log File vulnerability?

The vulnerability ID is CVE-2023-31422.

What is the severity of the CVE-2023-31422 vulnerability?

The severity of the CVE-2023-31422 vulnerability is critical with a severity value of 9.

Which version of Kibana is affected by the CVE-2023-31422 vulnerability?

The CVE-2023-31422 vulnerability affects Kibana version 8.10.0.

How can I fix the CVE-2023-31422 vulnerability?

To fix the CVE-2023-31422 vulnerability, update Kibana to version 8.10.1.

Where can I find more information about the CVE-2023-31422 vulnerability?

You can find more information about the CVE-2023-31422 vulnerability in the references provided: [link1](https://discuss.elastic.co/t/kibana-8-10-1-security-update/343287) and [link2](https://www.elastic.co/community/security).

Vulnerability/
CVE-2023-31422

critical

CWE

532

26/10/2023

17/9/2024

CVE-2023-31422: Kibana Insertion of Sensitive Information into Log File

First published: Thu Oct 26 2023(Updated: )

An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern. Elastic has released Kibana 8.10.1 which resolves this issue. The error object recorded in the log contains request information, which can include sensitive data, such as authentication credentials, cookies, authorization headers, query params, request paths, and other metadata. Some examples of sensitive data which can be included in the logs are account credentials for kibana_system, kibana-metricbeat, or Kibana end-users.

Credit: bressers@elastic.co

Affected Software	Affected Version	How to fix
Elastic Kibana	=8.10.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the vulnerability ID for the Kibana Insertion of Sensitive Information into Log File vulnerability?
The vulnerability ID is CVE-2023-31422.
What is the severity of the CVE-2023-31422 vulnerability?
The severity of the CVE-2023-31422 vulnerability is critical with a severity value of 9.
Which version of Kibana is affected by the CVE-2023-31422 vulnerability?
The CVE-2023-31422 vulnerability affects Kibana version 8.10.0.
How can I fix the CVE-2023-31422 vulnerability?
To fix the CVE-2023-31422 vulnerability, update Kibana to version 8.10.1.
Where can I find more information about the CVE-2023-31422 vulnerability?
You can find more information about the CVE-2023-31422 vulnerability in the references provided: [link1](https://discuss.elastic.co/t/kibana-8-10-1-security-update/343287) and [link2](https://www.elastic.co/community/security).

collector/nvd-api
agent/references
agent/type
agent/softwarecombine
agent/first-publish-date
collector/mitre-cve
source/MITRE
agent/title
agent/weakness
agent/last-modified-date
agent/severity
agent/author
agent/tags
agent/event
agent/description
vendor/elastic
canonical/elastic kibana
version/elastic kibana/8.10.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.