CVE-2025-37728

Description

A flaw was found in Kibana where the CrowdStrike connector stores credentials in a way that allows them to be accessed from other spaces. A malicious user could create and run a CrowdStrike connector in a space they control to access cached credentials belonging to another space, leading to unauthorized data access or manipulation.

Statement

The impact is MODERATE because the exploitation requires a Kibana user with access to at least one space to trigger the attack. However, once exploited, the flaw exposes stored CrowdStrike API credentials that could be used to query or modify protected resources. The issue is fundamentally caused by insufficient credential isolation between spaces in the CrowdStrike connector.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5.4N/AN/A
Attack VectorNetworkN/AN/A
Attack ComplexityLowN/AN/A
Privileges RequiredLowN/AN/A
User InteractionNoneN/AN/A
ScopeUnchangedN/AN/A
ConfidentialityLowN/AN/A
Integrity ImpactLowN/AN/A
Availability ImpactNoneN/AN/A

Vector

Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Understanding the Weakness (CWE)

CWE-522

Access Control

Technical Impact: Gain Privileges or Assume Identity

An attacker could gain access to user accounts and access sensitive data used by the user accounts.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.