This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Elastic fixes 2 vulnerabilities

Elastic fixes 2 vulnerabilities in its products [1][2]. Products and their fixed versions: Elasticsearch - 8.19.8, 9.1.8, 9.2.2 [1] Kibana - 8.19.8, 9.1.8, 9.2.2 [2]

Elasticsearch - user impersonation (CVE-2025-37731)
CVSS 6.8 (Medium)

Due to an incorrect implementation of authentication in the PKI mechanism in Elasticsearch, an authenticated remote attacker can impersonate another user. This is possible via a specially crafted client certificate signed by a trusted certificate authority [1].

The vulnerability is present in product:

  • Elasticsearch; >=7.0.0, <=7.17.29; >=8.0.0, <8.19.8; >=9.0.0, <9.1.8; >=9.2.0, <9.2.2;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 15. 12. 2025.

Elastic Kibana - XSS (CVE-2025-37732)
CVSS 5.4 (Medium)

Due to insufficient input sanitization in Kibana, an authenticated remote attacker with a role that includes the All privilege in the Management section for Fleet and Integrations can carry out a stored XSS attack [2].

The vulnerability is present in product:

  • Kibana; >=7.0.0, <=7.17.29; >=8.0.0, <8.19.8; >=9.0.0, <9.1.8; >=9.2.0, <9.2.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

More information:

  • CVE-2025-37732 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 15. 12. 2025.

By CESNET, z.s.p.o. Henrieta Paločková on 16. 12. 2025.

CESNET, z.s.p.o. Logo