CVE-2024-12556

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-12556

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12556.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-12556

Aliases

Published

2025-04-08T20:04:22.103Z

Modified

2026-07-15T01:49:13.595258974Z

Severity

8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Kibana Prototype Pollution can lead to code injection

Details

Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.

Database specific

{
    "cwe_ids": [
        "CWE-1321"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12556.json",
    "cna_assigner": "elastic"
}

References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type

GIT

Repo

https://github.com/elastic/elasticsearch

Events

Introduced

ffe992aa682c1968b5df375b5095b3a21f122bf3

Fixed

3a298fc72352e1b1be92b6619c29d875d64df820

Introduced

2b6a7fed44faa321997703718f07ee0420804b41

Fixed

747663ddda3421467150de0e4301e8d4bc636b0c

Database specific

{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.16.1"
        },
        {
            "fixed": "8.16.4"
        },
        {
            "introduced": "8.17.0"
        },
        {
            "fixed": "8.17.2"
        }
    ],
    "source": "CPE_RANGE"
}

Type

GIT

Repo

https://github.com/elastic/kibana

Events

Introduced

c8b46e87c4d61de4fe046ce5ea0a0b68aad5acf9

Fixed

4d74e2c041a2e9b7c6cefe20d106cde5f3d2439c

Introduced

86cbc85e621f4f3f701ed230f4e859ac5a80145b

Fixed

d7985c80643203de533d99844eb1b53cae85f8f9

Database specific

{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.16.1"
        },
        {
            "fixed": "8.16.4"
        },
        {
            "introduced": "8.17.0"
        },
        {
            "fixed": "8.17.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v8.*

v8.16.1

v8.16.2

v8.16.3

v8.17.0

v8.17.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12556.json"