Critical Kibana Vulnerability Let Attackers Execute Arbitrary Code

Organizations using Kibana for security monitoring (via Elastic Security) face heightened risks, as attackers could disable alerts or manipulate threat-detection pipelines. By injecting malicious payloads into these workflows, attackers can manipulate JavaScript object prototypes, a technique known as prototype pollution, to bypass security controls and execute arbitrary code. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. A critical security vulnerability in LibreOffice tracked as CVE-2025-1080, has exposed millions of users to potential remote code execution attacks through manipulated macro URLs. The flaw, rated 9.9 on the CVSS v3.1 scale, stems from a prototype pollution issue in Kibana’s file upload handler and HTTP request processing. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. Organizations fail to patch risk regulatory penalties under GDPR and HIPAA, given Kibana’s frequent processing of sensitive data. This attack vector is classified under CWE-1321 (Improper Control of Prototype-Based Attribute Modifications) and aligns with MITRE ATT&CK tactic T1059 (Command and Scripting Interpreter). This incident underscores the critical need for real-time vulnerability monitoring in data analytics platforms. She is covering various cyber security incidents happening in the Cyber Space. Elastic’s advisory warns that exploitation is “trivial” for attackers with valid credentials, requiring no advanced tooling or reverse engineering.

This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 06 Mar 2025 10:55:44 +0000


Cyber News related to Critical Kibana Vulnerability Let Attackers Execute Arbitrary Code

Critical Kibana Vulnerability Let Attackers Execute Arbitrary Code - According to the security advisory released on May 6, the vulnerability is a prototype pollution issue that enables attackers to execute arbitrary code via crafted HTTP requests specifically targeting Kibana’s Machine Learning and Reporting ...
2 weeks ago Cybersecuritynews.com CVE-2025-25014
CVE-2023-46675 - An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The ...
1 year ago Tenable.com
Critical Kibana Vulnerability Let Attackers Execute Arbitrary Code - Organizations using Kibana for security monitoring (via Elastic Security) face heightened risks, as attackers could disable alerts or manipulate threat-detection pipelines. By injecting malicious payloads into these workflows, attackers can ...
2 months ago Cybersecuritynews.com CVE-2025-1080
CVE-2022-23711 - A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the health and performance of your Elasticsearch cluster. ...
3 years ago
CVE-2017-8443 - In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear ...
4 years ago
CVE-2023-31422 - An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the ...
1 year ago
CVE-2020-7012 - Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. ...
4 years ago
CVE-2019-7610 - Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute ...
5 years ago
CVE-2023-31414 - Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker ...
2 years ago
Kibana Security Update - Patch for Vulnerability Leads to Code Injection - Organizations using Kibana should review their security posture, ensure proper access controls are in place, and implement the recommended mitigations to protect against this and other potential vulnerabilities in their data visualization ...
1 month ago Cybersecuritynews.com
CVE-2020-7013 - Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead ...
4 years ago
CVE-2018-17246 - Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to ...
4 years ago
CVE-2025-25015 - Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. ...
2 months ago
CVE-2020-27816 - The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR ...
4 years ago
CVE-2019-7616 - Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana access could set the timelion:graphite.url configuration option to an ...
2 years ago
CVE-2021-22139 - Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host ...
4 years ago
CVE-2019-13423 - Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong credentials when all of the following conditions a-c are true: a) Kibana ...
4 years ago
CVE-2020-7016 - Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user can lead to the Kibana process consuming large amounts of CPU and becoming unresponsive. ...
2 years ago
CVE-2023-46671 - An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account ...
1 year ago Tenable.com
CVE-2024-43708 - An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana. ...
3 months ago Tenable.com
What CIRCIA Means for Critical Infrastructure Providers and How Breach and Attack Simulation Can Help - Cyber Defense Magazine - To prepare themselves for future attacks, organizations can utilize BAS to simulate real-world attacks against their security ecosystem, recreating attack scenarios specific to their critical infrastructure sector and function within that sector, ...
7 months ago Cyberdefensemagazine.com Akira
Opening Statement by CISA Director Jen Easterly - Chairman Gallagher, Ranking Member Krishnamoorthi, Members of the Committee, thank you for the opportunity to testify on CISA's efforts to protect the Nation from the preeminent cyber threat posed by the People's Republic of China. As America's ...
1 year ago Cisa.gov
The Exploration of Static vs Dynamic Code Analysis - Two essential methodologies employed for this purpose are Static Code Analysis and Dynamic Code Analysis. Static Code Analysis involves the examination of source code without its execution. In this exploration of Static vs Dynamic Code Analysis, ...
1 year ago Feeds.dzone.com
A Plan to Protect Critical Infrastructure from 21st Century Threats - On April 30th, the White House released National Security Memorandum-22 on Critical Infrastructure Security and Resilience, which updates national policy on how the U.S. government protects and secures critical infrastructure from cyber and ...
11 months ago Cisa.gov
CVE-2019-7618 - A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with ...
4 years ago

Cyber Trends (last 7 days)