CVE-2025-25017CWE-79cross-site-scripting

CVE-2025-25017

High · published October 10, 2025

CVSS v3.1
8.2
EPSS
0%
Percentile
18.9
In the wild
Unconfirmed
What it is

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00275 · 18.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-10T14:15Z
Affected products (4)
ProductVersionsFixed in
elastic/kibana≥ 7.0.0, < 8.18.88.18.8
elastic/kibana≥ 8.19.0, < 8.19.48.19.4
elastic/kibana≥ 9.0.0, < 9.0.79.0.7
elastic/kibana≥ 9.1.0, < 9.1.49.1.4
References (1)
https://discuss.elastic.co/t/kibana-8-18-8-8-19-4-9-0-7-9-1-4-security-update-esa-2025-16/382450 · [email protected]
EPSS history
Timeline
  • 10 OCT 09:53Z
    Kibana Stored Cross-Site Scripting (XSS)
    cvelistv5