Skip to content
OpenAdvisories
High WID-SEC-2025-2216 4 CVEs

Kibana: Mehrere Schwachstellen

Published Oct 6, 2025 · Updated Dec 15, 2025 · Revision 5 · de-DE

Platform: Windows

Summary

Ein entfernter authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Cross-Site-Scripting-Angriffe zu starten oder vertrauliche Informationen offenzulegen.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 4

  • High 8.7
    CVE-2025-25009

    Kibana Cross-Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

    Elastic Kibana
  • High 8.7
    CVE-2025-25018

    Kibana Stored Cross-Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

    Elastic Kibana
  • High 8.2
    CVE-2025-25017

    Kibana Stored Cross-Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)

    Elastic Kibana
  • Medium 5.4
    CVE-2025-37728

    Kibana Insufficiently Protected Credentials in the CrowdStrike Connector

    Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in…

    Elastic Kibana

Revision history

  1. #5

    Referenz(en) aufgenommen: EUVD-2025-203357

  2. #4

    Referenz(en) aufgenommen: EUVD-2025-33707, EUVD-2025-33705

  3. #3

    Referenz(en) aufgenommen: EUVD-2025-32080, EUVD-2025-32075

  4. #2

    Referenz(en) aufgenommen: EUVD-2025-32867, EUVD-2025-32872

  5. #1

    Initiale Fassung

References