BIT-elk-2025-37732

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/elk/BIT-elk-2025-37732.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-elk-2025-37732

Aliases

Published

2025-12-18T11:37:43.350Z

Modified

2025-12-18T12:26:15.741379Z

Summary

Kibana Cross-site Scripting via the Integration Package Upload Functionality

Details

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.

Database specific

{
    "cpes": [
        "cpe:2.3:a:elasticsearch:kibana:*:*:*:*:*:node.js:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / elk

Package

Name: elk
Purl: pkg:bitnami/elk

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.19.8

Introduced

9.0.0

Fixed

9.1.8

Introduced

9.2.0

Fixed

9.2.2

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/elk/BIT-elk-2025-37732.json"