Vulnerabilitycritical
Elastic Releases Urgent Fix for Critical Kibana Vulnerability Enabling Remote Code Execution
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-37285 | A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload | 7.2 | 1% | ||
| CVE-2024-37287 | A flaw allowing arbitrary code execution was discovered in Kibana | 7.2 | 2% | ||
| CVE-2024-37288 | A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload | 8.8 | 1% | ||
| CVE-2025-25012 | URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a… | 5.4 | <1% | ||
| CVE-2025-25015 | Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests | 9.9 | 1% |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Mar 06, 2025 Data Security / Software Security Elastic has rolled out security updates to address a critical security flaw impacting the Kibana data visualization dashboard software for Elasticsearch that could result in arbitrary code execution. The vulnerability, tracked as CVE-2025-25015 , carries a CVSS score of 9. 9 out of a maximum of 10.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.