PT-2025-18389 · Elastic · Kibana

Published 2025-05-01 · Updated 2025-05-05 · CVE-2024-11390

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description The issue allows for the unrestricted upload of files with dangerous types, potentially leading to arbitrary JavaScript execution in a victim's browser, resulting in a cross-site scripting (XSS) attack. This can be achieved via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app and/or have write access to the synthetics indices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BIT-ELK-2024-11390

BIT-KIBANA-2024-11390

CVE-2024-11390

Affected Products

Kibana

References · 8

• https://osv.dev/vulnerability/BIT-elk-2024-11390 · Vendor Advisory
• https://discuss.elastic.co/t/kibana-7-17-24-and-8-12-0-security-update-esa-2024-20/377712 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-kibana-2024-11390 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-11390 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11390 · Security Note
• https://twitter.com/CVEnew/status/1918014676358606995 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1919272881973780575 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11390 · Note