CVE-2024-11390
Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS
Summary
Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS
Original description
The description as published by the source.
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.
The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
Affected packages
Bitnami
elk
[{"type":"SEMVER","events":[{"introduced":"7.17.6"},{"fixed":"7.17.23"},{"introduced":"8.4.0"},{"fixed":"8.12.0"}]}]
Bitnami
kibana
[{"type":"SEMVER","events":[{"introduced":"7.17.6"},{"fixed":"7.17.23"},{"introduced":"8.4.0"},{"fixed":"8.12.0"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.elastic.co