Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-11390

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.

Published

2025-05-01T14:15:34.913

Last Modified

2025-10-01T19:29:57.070

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 5.4 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-434
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application elastic kibana < 7.17.24 Yes
Application elastic kibana < 8.12.0 Yes
References