CVE-2022-23711

A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the health and performance of your Elasticsearch cluster. Authentication with a vulnerable Kibana instance is not required to view the exposed information. The Elastic Stack monitoring exposure only impacts users that have set any of the optional monitoring.ui.elasticsearch.* settings in order to configure Kibana as a remote UI for Elastic Stack Monitoring. The same vulnerability in Kibana could expose other non-sensitive application-internal information in the page source.

• CWE-200

• https://discuss.elastic.co/t/kibana-7-17-3-and-8-1-3-security-update/302826Vendor Advisory
• https://discuss.elastic.co/t/kibana-7-17-3-and-8-1-3-security-update/302826Vendor Advisory

Published

Apr 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23706A remote cross-site scripting (xss) vulnerability was discov…6.1
• CVE-2022-23707An XSS vulnerability was found in Kibana index patterns. Usi…5.4
• CVE-2022-23708A flaw was discovered in Elasticsearch 7.17.0’s upgrade assi…4.3
• CVE-2022-23709A flaw was discovered in Kibana in which users with Read acc…4.3
• CVE-2022-2371The YaySMTP WordPress plugin before 2.2.1 does not have prop…5.4
• CVE-2022-23710A cross-site-scripting (XSS) vulnerability was discovered in…6.1
• CVE-2022-23712A Denial of Service flaw was discovered in Elasticsearch. Us…7.5
• CVE-2022-23713A cross-site-scripting (XSS) vulnerability was discovered in…6.1
• CVE-2022-23714A local privilege escalation (LPE) issue was discovered in t…7.8
• CVE-2022-23715A flaw was discovered in ECE before 3.4.0 that might lead to…6.5
• CVE-2022-23716A flaw was discovered in ECE before 3.1.1 that could lead to…5.3
• CVE-2022-23717PingID Windows Login prior to 2.8 is vulnerable to a denial …5.5