Elastic

Kibana

106 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2025-25012

  • EPSS 0.26%
  • Veröffentlicht 25.06.2025 11:52:53
  • Zuletzt bearbeitet 30.09.2025 20:27:39

URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.

8.8

CVE-2024-43706

  • EPSS 0.27%
  • Veröffentlicht 10.06.2025 16:59:54
  • Zuletzt bearbeitet 01.10.2025 15:27:00

Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.

9.8

CVE-2025-25014

  • EPSS 2.54%
  • Veröffentlicht 06.05.2025 17:30:45
  • Zuletzt bearbeitet 02.10.2025 16:26:53

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

5.4

CVE-2024-11390

  • EPSS 0.27%
  • Veröffentlicht 01.05.2025 13:11:14
  • Zuletzt bearbeitet 01.10.2025 19:29:57

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write...

4.3

CVE-2025-25016

  • EPSS 0.19%
  • Veröffentlicht 01.05.2025 13:09:16
  • Zuletzt bearbeitet 02.10.2025 16:34:04

Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.

9.8

CVE-2024-12556

  • EPSS 1.12%
  • Veröffentlicht 08.04.2025 20:15:19
  • Zuletzt bearbeitet 02.10.2025 15:27:30

Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.

6.5

CVE-2024-52974

  • EPSS 0.29%
  • Veröffentlicht 08.04.2025 16:46:44
  • Zuletzt bearbeitet 30.09.2025 21:36:21

An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.

9.9

CVE-2025-25015

  • EPSS 0.74%
  • Veröffentlicht 05.03.2025 10:15:20
  • Zuletzt bearbeitet 02.10.2025 17:53:04

Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 ...

6.5

CVE-2024-43708

  • EPSS 0.33%
  • Veröffentlicht 23.01.2025 11:15:10
  • Zuletzt bearbeitet 30.09.2025 20:56:18

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.

6.5

CVE-2024-52972

  • EPSS 0.22%
  • Veröffentlicht 23.01.2025 07:15:08
  • Zuletzt bearbeitet 30.09.2025 20:57:56

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in K...