# A question about a potential vulnerability in Kibana

**URL:** <https://discuss.elastic.co/t/a-question-about-a-potential-vulnerability-in-kibana/323195>\
**Category:** Kibana\
**Created:** [January 15, 2023, 10:58am UTC](https://discuss.elastic.co/t/a-question-about-a-potential-vulnerability-in-kibana/323195 "2023-01-15T10:58:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![frenkel](https://avatars.discourse-cdn.com/v4/letter/f/dec6dc/32.png) [@frenkel](https://discuss.elastic.co/u/frenkel)\
**Post date:** [January 15, 2023, 10:58am UTC](https://discuss.elastic.co/t/a-question-about-a-potential-vulnerability-in-kibana/323195/1 "2023-01-15T10:58:03Z")

</div>

Hi,

There is this CVE about a vulnerability in JsonWebToken:  
[https://nvd.nist.gov/vuln/detail/CVE-2022-23529](https://nvd.nist.gov/vuln/detail/CVE-2022-23529)  
This is a vulnerability about insecure input validation in jwt.verify function, in JsonWebToken versions \<= 8.5.1.

We are using Kibana 7.8.0 in our product and we see that there are some usages of JsonWebToken in the Kibana files.

My question is, is Kibana vulnerable to this CVE?

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 15, 2023, 10:15pm UTC](https://discuss.elastic.co/t/a-question-about-a-potential-vulnerability-in-kibana/323195/2 "2023-01-15T22:15:48Z")

</div>

7.8 is very much [EOL](https://www.elastic.co/support/eol) and you are unlikely to get a response for that particular version other than you need to upgrade.

For newer versions I would suggest checking out [Security issues | Elastic](https://www.elastic.co/community/security) and emailing [security@elastic.co](mailto:security@elastic.co).

---

<div class="post-metadata">

**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\
**Post date:** [January 15, 2023, 10:27pm UTC](https://discuss.elastic.co/t/a-question-about-a-potential-vulnerability-in-kibana/323195/3 "2023-01-15T22:27:14Z")

</div>

Sidenote: We'll see what happens to that one [[GHSA-27h2-hvpr-p74q] Request to reject CVE: jsonwebtoken has insecure input validation in jwt.verify function by MichaelErmer · Pull Request #1595 · github/advisory-database · GitHub](https://github.com/github/advisory-database/pull/1595) 😅

---

<div class="post-metadata">

**Author:** ![frenkel](https://avatars.discourse-cdn.com/v4/letter/f/dec6dc/32.png) [@frenkel](https://discuss.elastic.co/u/frenkel)\
**Post date:** [January 16, 2023, 7:23pm UTC](https://discuss.elastic.co/t/a-question-about-a-potential-vulnerability-in-kibana/323195/4 "2023-01-16T19:23:20Z")

</div>

Thanks.  
I can't find the CVE in the page you provided, is it possible to get an answer here about this vulnerability for newer versions of Kibana? Or the only place I could get an answer is via [security@elastic.co](mailto:security@elastic.co)?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 13, 2023, 7:24pm UTC](https://discuss.elastic.co/t/a-question-about-a-potential-vulnerability-in-kibana/323195/5 "2023-02-13T19:24:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.