CVE-2025-25015
Kibana arbitrary code execution via prototype pollution
Summary
Kibana arbitrary code execution via prototype pollution
Original description
The description as published by the source.
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests.
In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors
Affected packages
Bitnami
elk
[{"type":"SEMVER","events":[{"introduced":"8.15.0"},{"fixed":"8.17.3"}]}]
Bitnami
kibana
[{"type":"SEMVER","events":[{"introduced":"8.15.0"},{"fixed":"8.17.3"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- web discuss.elastic.co
- web discuss.elastic.co