We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-11390

Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS



Description

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.

Reserved 2024-11-18 | Published 2025-05-01 | Updated 2025-05-01 | Assigner elastic


MEDIUM: 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

Product status

Default status
unaffected

7.17.6 before 7.17.23
affected

8.4.0 before 8.11.4
affected

References

discuss.elastic.co/...2-0-security-update-esa-2024-20/377712

cve.org (CVE-2024-11390)

nvd.nist.gov (CVE-2024-11390)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2024-11390

Support options

Helpdesk Chat, Email, Knowledgebase
© Copyright 2025 THREATINT
Made in Cyprus with ❤ + ☼
 System status
Find us on
Data Privacy
Terms of Use
Logo BSI Allianz für Cyber-Sicherheit
Error loading Crisp.chat. Please check your web content filter and browser plugins.