CVE-2024-11390

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-11390
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-11390.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-11390
Aliases
Published
2025-05-01T14:15:34.913Z
Modified
2026-04-10T05:08:16.770012Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.

The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.

References

Affected packages

Git / github.com/elastic/kibana

Affected ranges

Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
d2647b053b769d4517fbb14ce37765808a1b6e0c
Fixed
4fb3ec3c959e4c569aca4674243a2ecba9d973a7
Introduced
1922ab0b6f8dc2906ef10f3fb65fc4d0e0076f90
Fixed
e9092c0a17923f4ed984456b8a5db619b0a794b3
Database specific 
{
    "versions": [
        {
            "introduced": "7.17.6"
        },
        {
            "fixed": "7.17.24"
        },
        {
            "introduced": "8.4.0"
        },
        {
            "fixed": "8.12.0"
        }
    ]
}

Affected versions

v7.*
v7.17.10
v7.17.11
v7.17.12
v7.17.13
v7.17.14
v7.17.15
v7.17.16
v7.17.17
v7.17.18
v7.17.19
v7.17.20
v7.17.21
v7.17.22
v7.17.23
v7.17.6
v7.17.7
v7.17.8
v7.17.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-11390.json"