Skip to content
OpenAdvisories
High WID-SEC-2025-2576 2 CVEs

Kibana: Mehrere Schwachstellen

Published Nov 11, 2025 · Updated Nov 13, 2025 · Revision 3 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 2

  • High 8.1
    CVE-2025-59840

    Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable

    Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode…

    vega vega jupyter-base-notebook py3.11-jupyterlab Debian Ubuntu Wolfi npm
  • Medium 4.3
    CVE-2025-37734

    Kibana Origin Validation Error

    Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

    Elastic Kibana

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2025-175359

  2. #2

    Referenz(en) aufgenommen: EUVD-2025-124976

  3. #1

    Initiale Fassung

References