CVE-2024-23446: Kibana Broken Access Control issue
An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{spaceid} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23446?
CVE-2024-23446 has a high severity rating due to its potential for unauthorized access to sensitive alerts.
How do I fix CVE-2024-23446?
To fix CVE-2024-23446, ensure that you upgrade to Elastic Kibana version 8.12.2 or later.
What does CVE-2024-23446 affect?
CVE-2024-23446 affects the Detection Engine Search API within Elastic Kibana, specifically related to Document-level and Field-level security checks.
Who is affected by CVE-2024-23446?
Users with authorization to call the Detection Engine Search API in Elastic Kibana are potentially affected by CVE-2024-23446.
Is there a workaround for CVE-2024-23446?
There are no official workarounds for CVE-2024-23446; upgrading to the patched version is the recommended solution.