CVE-2024-11390
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.
The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
Vendor
Product
CWE
Yayın Tarihi
2025-05-01 14:15:34
Güncelleme
2025-10-01 19:29:57
Source Identifier
security@elastic.co
KEV Date Added
-