Skip to content
Fencer Intel
medium 4.3

CVE-2022-23709 json

A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules.

published 4y ago modified 4mo ago also EUVD-2022-28647

cvss
4.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modified rules would not be enabled, and a user with this privilege could not modify alerting connectors. This effectively means that Read users could disable existing alerting rules.

Patch / fix

  • elastic kibana 7.17.1

Is CVE-2022-23709 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23709 updated cvss 4.3

kibana: missing authorization issue (ESA-2022-03)

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8, openshift-logging/elasticsearch-rhel8-operator
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Fuse 6 Kibana Kibana Red Hat JBoss Fuse Service Works 6 Kibana Kibana
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 kibana, openshift3/ose-logging-kibana5
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-logging-kibana6, openshift4/ose-elasticsearch-operator
    affected: no fix available “Fix deferred”
  • Red Hat OpenStack Platform 13 (Queens) puppet-kibana3
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 16.1 puppet-kibana3 Red Hat OpenStack Platform 16.2 puppet-kibana3
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N

Affected products

  • Elastic kibana

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls
  • CWE-862 Missing Authorization

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.