This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Elastic Kibana fixes 2 vulnerabilities

Elastic versions 8.18.8, 8.19.5, 9.0.8 and 9.1.5 fix 2 vulnerabilities in Kibana [1].

Elastic Kibana - XSS (CVE-2025-25018)
CVSS 8.7 (High)

Allows an authenticated remote attacker with a role including all privileges in the Management section for Fleet and Integrations to perform an XSS attack due to improper neutralisation of input [1].

The vulnerability is present in product:

  • Kibana; >=7.0.0, <=7.17.29; >=8.0.0, <=8.18.7; >=8.19.0, <=8.19.4; >=9.0.0, <=9.0.7; >=9.1.0, <=9.1.4

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

More information:

  • CVE-2025-25018 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 6. 10. 2025.

Elastic Kibana - XSS (CVE-2025-25017)
CVSS 8.2 (High)

Allows an unauthenticated remote attacker to perform an XSS attack due to improper neutralisation of input during web page generation in Vega visualisations. If updating is not possible, you can disable Vega visualisations as described in [2].

The vulnerability is present in product:

  • Kibana; >=7.0.0, <=7.17.29; >=8.0.0, <=8.18.7; >=8.19.0, <=8.19.3; >=9.0.0, <=9.0.6; >=9.1.0, <=9.1.3

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

More information:

  • CVE-2025-25017 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 6. 10. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 13. 10. 2025.

CESNET, z.s.p.o. Logo