CVE-2024-12556

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-12556
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12556.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-12556
Aliases
Published
2025-04-08T20:04:22Z
Modified
2026-08-12T14:51:59Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Kibana Prototype Pollution can lead to code injection
Details

Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.

Database specific 
{
    "cna_assigner": "elastic",
    "cwe_ids": [
        "CWE-1321"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12556.json"
}
References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type
GIT
Repo
https://github.com/elastic/elasticsearch
Events
Introduced
ffe992aa682c1968b5df375b5095b3a21f122bf3
Fixed
3a298fc72352e1b1be92b6619c29d875d64df820
Introduced
2b6a7fed44faa321997703718f07ee0420804b41
Fixed
747663ddda3421467150de0e4301e8d4bc636b0c
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.16.1"
        },
        {
            "fixed": "8.16.4"
        },
        {
            "introduced": "8.17.0"
        },
        {
            "fixed": "8.17.2"
        }
    ],
    "source": "CPE_RANGE"
}
Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
c8b46e87c4d61de4fe046ce5ea0a0b68aad5acf9
Fixed
4d74e2c041a2e9b7c6cefe20d106cde5f3d2439c
Introduced
86cbc85e621f4f3f701ed230f4e859ac5a80145b
Fixed
d7985c80643203de533d99844eb1b53cae85f8f9
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.16.1"
        },
        {
            "fixed": "8.16.4"
        },
        {
            "introduced": "8.17.0"
        },
        {
            "fixed": "8.17.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v8.*
v8.16.1
v8.16.2
v8.16.3
v8.17.0
v8.17.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12556.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "263356833667147417207880542417020229118",
            "length": 346
        },
        "id": "CVE-2024-12556-19a84879",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/747663ddda3421467150de0e4301e8d4bc636b0c",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/index/mapper/ObjectMapper.java",
            "function": "setIgnoredValues"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "168799588092401371349937989380744438042",
                "242259272325545759304556204886294254385",
                "78134022479182254435201794946905021050"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-12556-b11c30a6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/747663ddda3421467150de0e4301e8d4bc636b0c",
        "target": {
            "file": "server/src/test/java/org/elasticsearch/index/mapper/IgnoredSourceFieldMapperTests.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "241650658189941592068922497856645279704",
                "245410000860545525443509860004509825878",
                "289885912327545093624921847601875478957",
                "56515432158717916672434292238886754568"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-12556-c2961f10",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/747663ddda3421467150de0e4301e8d4bc636b0c",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/index/mapper/ObjectMapper.java"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T14:51:59Z"