CyberRota Analysis
AI-GeneratedThe vulnerability in Kibana's Fleet feature allows authenticated users with read-level privileges to access and enumerate agent metadata and diagnostic content from other Kibana spaces, leading to potential information disclosure. This issue arises from a lack of proper authorization checks, enabling privilege abuse. Organizations using Kibana, particularly those managing multiple spaces with varying access levels, should prioritize addressing this vulnerability to safeguard sensitive information.
Original NVD Description
Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.