CVE-2025-37732CWE-79cross-site-scripting

CVE-2025-37732

Medium · published December 15, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00181 · 7.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-15T16:15Z
Affected products (4)
ProductVersionsFixed in
elastic/kibana≥ 7.0.0, ≤ 7.17.29—
elastic/kibana≥ 8.0.0, < 8.19.88.19.8
elastic/kibana≥ 9.0.0, < 9.1.89.1.8
elastic/kibana≥ 9.2.0, < 9.2.29.2.2
References (1)
https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-28/384064 · [email protected]
EPSS history
Timeline
  • 15 DEC 10:21Z
    Kibana Cross-site Scripting via the Integration Package Upload Functionality
    cvelistv5