File Upload Vulnerability in Kibana by Elastic

CVE-2024-11390

What is CVE-2024-11390?

A vulnerability in Kibana allows for the unrestricted upload of files that can contain malicious HTML and JavaScript. This can result in arbitrary JavaScript being executed in the browser of users interacting with the affected Kibana instance. For exploitation, the attacker must possess access to the Synthetics app and/or the ability to write to the synthetics indices, making it crucial for users to review their access controls and monitor for any suspicious activities.

References