CVE-2024-11390
Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS
Résumé
Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.
The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
Paquets affectés
Bitnami
elk
[{"type":"SEMVER","events":[{"introduced":"7.17.6"},{"fixed":"7.17.23"},{"introduced":"8.4.0"},{"fixed":"8.12.0"}]}]
Bitnami
kibana
[{"type":"SEMVER","events":[{"introduced":"7.17.6"},{"fixed":"7.17.23"},{"introduced":"8.4.0"},{"fixed":"8.12.0"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.elastic.co