CVE-2023-46671

    Dashboard / Vulnerabilities / CVE-2023-46671

    CVE-2023-46671

    Published: 13 Dec 2023Last Modified: 28 Oct 2026

    Summary: Kibana Insertion of Sensitive Information into Log File

    Details: An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users. The issue occurs infrequently, only if an error is returned from an Elasticsearch cluster, in cases where there is user interaction and an unhealthy cluster (for example, when returning circuit breaker or no shard exceptions).

    References: https://discuss.elastic.co/t/8-11-1-7-17-15-security-update-esa-2023-25/347149, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46671.json, https://nvd.nist.gov/vuln/detail/CVE-2023-46671

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 1b6a7ece17463df5ff54a3e1302d825889aa1161
    Fixed -6f9ff581fbcde658e6f69d6ce03050f060d1fd0c

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-46671 | CVE-DB