Kibana Prototype Pollution can lead to code injection (ESA-2025-02)
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.
Affected Versions:
Kibana version 8.16.1 up to and including 8.17.1
Solutions and Mitigations:
Users should upgrade to version 8.16.4 and 8.17.2 or higher
For Users that cannot upgrade:
Customers who cannot upgrade to 8.16.4 or 8.17.2 and must stay on 8.16.1 can disable the integration assistant by setting xpack.integration_assistant.enabled: false in their kibana.yml configuration file.
Severity: CVSS v3.1: 8.7(High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVE ID: CVE-2024-12556