# Question related to ESA-2025-06 (security advisory)

**URL:** <https://discuss.elastic.co/t/question-related-to-esa-2025-06-security-advisory/375521>\
**Category:** Elastic Security\
**Created:** [March 6, 2025, 12:57pm UTC](https://discuss.elastic.co/t/question-related-to-esa-2025-06-security-advisory/375521 "2025-03-06T12:57:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tears](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tears/32/141851_2.png) [@Tears](https://discuss.elastic.co/u/Tears)\
**Post date:** [March 6, 2025, 12:57pm UTC](https://discuss.elastic.co/t/question-related-to-esa-2025-06-security-advisory/375521/1 "2025-03-06T12:57:36Z")

</div>

Hello,

[ESA-2025-06](https://discuss.elastic.co/t/kibana-8-17-3-security-update-esa-2025-06/375441) is a security advisory about a prototype pollution vulnerability. This avisory references the following CVE ID : **CVE-2025-25012**

Unless I'm mistaken, there is a different CVE ID in the mitre API for the very same vulnerability :

- **CVE-2025-25015** : _Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests.In Kibana versions \>= 8.15.0 and \< 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors_

Is it a duplicate CVE or an error in ESA-2025-06 ?

Thank you in advance !

---

<div class="post-metadata">

**Author:** ![RylandHerrick](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rylandherrick/32/67401_2.png) [@RylandHerrick](https://discuss.elastic.co/u/RylandHerrick)\
**Post date:** [March 7, 2025, 2:26am UTC](https://discuss.elastic.co/t/question-related-to-esa-2025-06-security-advisory/375521/2 "2025-03-07T02:26:14Z")

</div>

Thank you for the correction, @Tears. The referenced CVE was in fact a typo, and the [advisory](https://discuss.elastic.co/t/kibana-8-17-3-security-update-esa-2025-06/375441) has since been amended.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 4, 2025, 2:26am UTC](https://discuss.elastic.co/t/question-related-to-esa-2025-06-security-advisory/375521/3 "2025-04-04T02:26:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.