Security Advisory

CVE-2024-11390

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-05-01 13:11:14

Last updated 2025-05-01 13:26:43

Assigner elastic

State PUBLISHED

Description

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.

← Browse all CVEs View on cve.org ↗