CVE-2025-25015
Kibana arbitrary code execution via prototype pollution
Résumé
Kibana arbitrary code execution via prototype pollution
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests.
In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors
Paquets affectés
Bitnami
elk
[{"type":"SEMVER","events":[{"introduced":"8.15.0"},{"fixed":"8.17.3"}]}]
Bitnami
kibana
[{"type":"SEMVER","events":[{"introduced":"8.15.0"},{"fixed":"8.17.3"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- web discuss.elastic.co
- web discuss.elastic.co