Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder Daten zu manipulieren.
Product
Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.
Vulnerabilities 2
-
Medium 5.4
Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the sy…
-
Medium 4.3
Kibana Unrestricted Upload of File
Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.
Revision history
-
#1
Initiale Fassung
References
-
Kibana 7.17.24 and 8.12.0 Security Update vom 2025-05-01
https://discuss.elastic.co/t/kibana-7-17-24-and-8-12-0-security-update-esa-2024-20/377712
-
Kibana 7.17.19 and 8.13.0 Security Update vom 2025-05-01
https://discuss.elastic.co/t/kibana-7-17-19-and-8-13-0-security-update-esa-2024-47/377711