CVE-2024-12556CWE-1321

Kibana Prototype Pollution can lead to code injection

High · published April 8, 2025

CVSS v3.1
8.7
EPSS
1%
Percentile
45.4
In the wild
Unconfirmed
What it is

Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00553 · 45.4th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2025-04-08T20:04Z
EPSS history
Timeline
  • 08 APR 20:04Z
    Kibana Prototype Pollution can lead to code injection
    cvelistv5