Skip to content
OpenAdvisories
Medium WID-SEC-2025-2899 5 CVEs

Kibana: Mehrere Schwachstellen

Published Dec 18, 2025 · Updated Dec 18, 2025 · de-DE

Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, vertrauliche Informationen offenzulegen, Daten zu manipulieren und einen Denial-of-Service-Zustand zu verursachen.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 5

  • High 7.2
    CVE-2025-68385

    Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in…

    Elastic Kibana
  • Medium 6.5
    CVE-2025-68389

    Kibana Allocation of Resources Without Limits or Throttling

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial of service (DoS) of the Kibana process via a crafted HTTP requ…

    Elastic Kibana
  • Medium 6.1
    CVE-2025-68387

    Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnera…

    Elastic Kibana
  • Medium 4.3
    CVE-2025-68386

    Kibana Improper Authorization

    Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the s…

    Elastic Kibana
  • Medium 4.3
    CVE-2025-68422

    Kibana Improper Authorization

    Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permissi…

    Elastic Kibana

Revision history

  1. #1

    Initiale Fassung

References