| Package | Affected versions | Patched versions |
|---|---|---|
| kibana | ≥ 7.17.6, < 7.17.24≥ 8.4.0, < 8.12.0 | 7.17.248.12.0 |
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free