CVE-2024-11390 — Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS

CVE-2024-11390

Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS PUBLISHED

Description (CNA)

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 7.17.6 before 7.17.23; affected 8.4.0 before 8.11.4

CWE

CWE-434

References

https://discuss.elastic.co/t/kibana-7-17-24-and-8-12-0-security-update-esa-2024-20/377712

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.