BIT-elk-2025-37732

vendorUSosv

Kibana Cross-site Scripting via the Integration Package Upload Functionality

view advisory published 2025-12-18Licence: per source

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-37732US	—	0.18% (8th)	—	2025-12-15
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integ…

references

External citations — patches, advisories, analysis.

https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-28/384064ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2025-37732WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan