CVE-2024-12556

CRITICAL9.8EPSS 0.58%

Kibana Prototype Pollution can lead to code injection

Published: 4/10/2025Modified: 10/3/2025
Also known as:BIT-elk-2024-12556BIT-kibana-2024-12556

Description

Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1CRITICAL9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)