medium5.4
CVE-2024-11390
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScr…
Impact
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Elastic | Kibana | from 7.17.6 before 7.17.24 from 8.4.0 before 8.12.0 |