CVE-2024-11390
- Source
- https://cve.org/CVERecord?id=CVE-2024-11390
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-11390.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-11390
- Aliases
- Published
- 2025-05-01T13:11:14.142Z
- Modified
- 2026-08-12T15:15:51.664550Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS
- Details
-
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.
The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
- Database specific
{ "cwe_ids": [ "CWE-434" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11390.json", "cna_assigner": "elastic" }- References
Affected packages
Git / github.com/elastic/elasticsearch
Affected ranges
Affected versions
v7.*
v7.17.10
v7.17.11
v7.17.12
v7.17.13
v7.17.14
v7.17.15
v7.17.16
v7.17.17
v7.17.18
v7.17.19
v7.17.20
v7.17.21
v7.17.22
v7.17.23
v7.17.6
v7.17.7
v7.17.8
v7.17.9
Database specific
vanir_signatures_modified
"2026-08-12T15:15:51Z"
vanir_signatures
[
{
"id": "CVE-2024-11390-04ed0c6d",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 469.0,
"function_hash": "119775420433353368888449704673258415513"
},
"source": "https://github.com/elastic/elasticsearch/commit/1665f706fd9354802c02146c1e6b5c0fbcddfbc9",
"target": {
"function": "get",
"file": "test/test-clusters/src/main/java/org/elasticsearch/test/cluster/local/DefaultEnvironmentProvider.java"
}
},
{
"id": "CVE-2024-11390-2899d756",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"252631153118237007171041294847793407275",
"151984004388923748600111248223214790718",
"148579302964524690079033955906110377205",
"83969663723161480770502355946479356825",
"11111893943075349556511057504450132701",
"254660440046973578497771903047837469318",
"302171287526990646720161932354220369100",
"162840583537448565816206157984972925469"
]
},
"source": "https://github.com/elastic/elasticsearch/commit/1665f706fd9354802c02146c1e6b5c0fbcddfbc9",
"target": {
"file": "test/test-clusters/src/main/java/org/elasticsearch/test/cluster/local/DefaultEnvironmentProvider.java"
}
},
{
"id": "CVE-2024-11390-a20ced95",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114875983746314892179413898728568252630",
"40232471339725546965955154410027233909",
"146656705597082492155136965235625380350",
"165945345971752722399723390879332786586"
]
},
"source": "https://github.com/elastic/elasticsearch/commit/1665f706fd9354802c02146c1e6b5c0fbcddfbc9",
"target": {
"file": "test/external-modules/die-with-dignity/src/javaRestTest/java/org/elasticsearch/qa/die_with_dignity/DieWithDignityIT.java"
}
},
{
"id": "CVE-2024-11390-ab23b0ed",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 5193.0,
"function_hash": "126401859950460619721188731901615641464"
},
"source": "https://github.com/elastic/elasticsearch/commit/1665f706fd9354802c02146c1e6b5c0fbcddfbc9",
"target": {
"function": "apply",
"file": "build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/test/rest/RestTestBasePlugin.java"
}
},
{
"id": "CVE-2024-11390-bfb335ee",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 297.0,
"function_hash": "336977401819381689801049493485899839603"
},
"source": "https://github.com/elastic/elasticsearch/commit/1665f706fd9354802c02146c1e6b5c0fbcddfbc9",
"target": {
"function": "startJcmd",
"file": "test/external-modules/die-with-dignity/src/javaRestTest/java/org/elasticsearch/qa/die_with_dignity/DieWithDignityIT.java"
}
},
{
"id": "CVE-2024-11390-c48c689a",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 77.0,
"function_hash": "302806869156825138967016505708747002294"
},
"source": "https://github.com/elastic/elasticsearch/commit/fcf25fff740db6ab3ed5d145c58d70e4c3528ea7",
"target": {
"function": "doRun",
"file": "x-pack/plugin/searchable-snapshots/src/internalClusterTest/java/org/elasticsearch/xpack/searchablesnapshots/cache/full/SearchableSnapshotsPrewarmingIntegTests.java"
}
},
{
"id": "CVE-2024-11390-e4c81f6d",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"15728880044678428613885107089167214246",
"173618939874799114652410357105564381038",
"293761876996285912564783256243232366190",
"198593980507136286893931030547799247876",
"206709190616943257201853921897333917313",
"197399493388089925234224283026471881528",
"44508774986651643012206413574234642238",
"166140435195922692091311330906342127134",
"196437853667451077775668990843785496875",
"333451065704095536815766263903785873394",
"72868878619308445828107324034491913956"
]
},
"source": "https://github.com/elastic/elasticsearch/commit/fcf25fff740db6ab3ed5d145c58d70e4c3528ea7",
"target": {
"file": "x-pack/plugin/searchable-snapshots/src/internalClusterTest/java/org/elasticsearch/xpack/searchablesnapshots/cache/full/SearchableSnapshotsPrewarmingIntegTests.java"
}
},
{
"id": "CVE-2024-11390-f406637e",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 9761.0,
"function_hash": "108010166469262082174614297143144359609"
},
"source": "https://github.com/elastic/elasticsearch/commit/fcf25fff740db6ab3ed5d145c58d70e4c3528ea7",
"target": {
"function": "testConcurrentPrewarming",
"file": "x-pack/plugin/searchable-snapshots/src/internalClusterTest/java/org/elasticsearch/xpack/searchablesnapshots/cache/full/SearchableSnapshotsPrewarmingIntegTests.java"
}
},
{
"id": "CVE-2024-11390-fa6974e7",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"208770898148811660317472649004368967747",
"77222967772934322118811833798506118124",
"178896071723307873887930421167283176160",
"147702948148653437249544830464361867437",
"179384613832128238157258269440206102286",
"93863779612561601416858181584879715864",
"291370154629426804295261764126694175177",
"291239316273735786041927222061863056561"
]
},
"source": "https://github.com/elastic/elasticsearch/commit/1665f706fd9354802c02146c1e6b5c0fbcddfbc9",
"target": {
"file": "build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/test/rest/RestTestBasePlugin.java"
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-11390.json"