BIT-elk-2025-37728

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/elk/BIT-elk-2025-37728.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-elk-2025-37728
Aliases
Published
2025-10-09T08:40:04.041Z
Modified
2025-10-09T09:27:21.630360Z
Summary
Kibana Insufficiently Protected Credentials in the CrowdStrike Connector
Details

Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in a space to which they have access.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:elasticsearch:kibana:*:*:*:*:*:node.js:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / elk

Package

Name
elk
Purl
pkg:bitnami/elk

Severity

  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.18.8
Introduced
8.19.0
Fixed
8.19.5
Introduced
9.0.0
Fixed
9.0.8
Introduced
9.1.0
Fixed
9.1.5

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/elk/BIT-elk-2025-37728.json"