CVE-2022-23709: 
Java vulnerability analysis and mitigation

A flaw was discovered in Kibana affecting versions 7.7.0 through 7.17.0, and 8.0.0, where users with Read access to the Uptime feature could modify alerting rules. This vulnerability allowed users to create new alerting rules or overwrite existing ones, although any new or modified rules would not be enabled, and users could not modify alerting connectors (Elastic Discussion).

The vulnerability is identified as CVE-2022-23709 and has been assigned a CVSSv3 score of 4.3 (Medium) with the following vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. This indicates a network-accessible vulnerability with low attack complexity, requiring low privileges, no user interaction, and affecting only the integrity of the system at a low level (Elastic Discussion).

The primary impact of this vulnerability is that users with Read privileges could effectively disable existing alerting rules by overwriting them. While they could create new rules or modify existing ones, these rules would not be enabled, and the users could not modify alerting connectors (Debian Security, Elastic Discussion).

The issue has been fixed in versions 7.17.1, 8.0.1, and 8.1.0. For users on affected versions who cannot immediately upgrade, the recommended mitigation is to avoid granting users Read access to the Uptime feature if they should not have the ability to create/modify alerts. Additionally, administrators should avoid using the built-in Viewer role (Elastic Discussion).