CVE-2024-11390

{"id": "CVE-2024-11390", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2025-05-01T14:15:34.913", "references": [{"url": "https://discuss.elastic.co/t/kibana-7-17-24-and-8-12-0-security-update-esa-2024-20/377712", "tags": ["Patch", "Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim\u2019s browser (XSS) via crafted HTML and JavaScript files.\n\nThe attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices."}, {"lang": "es", "value": "La carga sin restricciones de un archivo con un tipo peligroso en Kibana puede provocar la ejecuci\u00f3n arbitraria de JavaScript en el navegador de la v\u00edctima (XSS) mediante archivos HTML y JavaScript manipulados. El atacante debe tener acceso a la aplicaci\u00f3n Synthetics y/o acceso para escribir en los \u00edndices de Synthetics."}], "lastModified": "2025-10-01T19:29:57.070", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5137392-15CF-4E0F-9619-DD538E71E23A", "versionEndExcluding": "7.17.24", "versionStartIncluding": "7.17.6"}, {"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6FE6D6C-E364-40E6-ACFD-B6B8D9F6742F", "versionEndExcluding": "8.12.0", "versionStartIncluding": "8.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}