CVE-2024-11390: Elastic Kibana

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.

Affected products

• Elastic Kibana: from 7.17.6, before 7.17.24 (fixed in 7.17.24); from 8.4.0, before 8.12.0 (fixed in 8.12.0)

Published 2025-05-01. Last modified 2026-06-17.