CVE-2022-23709

    Dashboard / Vulnerabilities / CVE-2022-23709

    CVE-2022-23709

    Published: 3 Mar 2022Last Modified: 24 Oct 2026

    Summary:

    Details: A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modified rules would not be enabled, and a user with this privilege could not modify alerting connectors. This effectively means that Read users could disable existing alerting rules.

    References: https://discuss.elastic.co/t/elastic-stack-7-17-1-security-update/298447, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23709.json, https://nvd.nist.gov/vuln/detail/CVE-2022-23709

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 81a1e9eda8e6183f5237786246f6dced26a10eaf
    Fixed -e5acb99f822233d62d6444ce45a4543dc1c8059a

    Affected versions

    8.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-23709 | CVE-DB