Description
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.
The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Kibana | 7.17.6 – < 7.17.23, 8.4.0 – < 8.11.4 | 7.17.23 |
Advisories 1
- WID-SEC-2025-0917 Kibana: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 1, 2025