Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2024-11390
Description
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
GitHub
elastic/kibana
Docker HubThe Kibana docker images maintained by Elastic!
Docker HubThe Kibana docker images maintained by Elastic!>= 7.17.6, < 7.17.24, >= 8.4.0, < 8.12.0NVD