{"id":"CVE-2024-11390","summary":"Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS","details":"Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.\n\nThe attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.","aliases":["BIT-elk-2024-11390","BIT-kibana-2024-11390"],"modified":"2026-08-12T15:15:51.664550Z","published":"2025-05-01T13:11:14.142Z","database_specific":{"cna_assigner":"elastic","cwe_ids":["CWE-434"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11390.json"},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/kibana-7-17-24-and-8-12-0-security-update-esa-2024-20/377712"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11390.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11390"},{"type":"PACKAGE","url":"https://github.com/elastic/kibana"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"f65e9d338dc1d07b642e14a27f338990148ee5b6"},{"fixed":"fcf25fff740db6ab3ed5d145c58d70e4c3528ea7"},{"introduced":"f56126089ca4db89b631901ad7cce0a8e10e2fe5"},{"fixed":"1665f706fd9354802c02146c1e6b5c0fbcddfbc9"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.17.6"},{"fixed":"7.17.24"},{"introduced":"8.4.0"},{"fixed":"8.12.0"}]}},{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"d2647b053b769d4517fbb14ce37765808a1b6e0c"},{"fixed":"4fb3ec3c959e4c569aca4674243a2ecba9d973a7"},{"introduced":"1922ab0b6f8dc2906ef10f3fb65fc4d0e0076f90"},{"fixed":"e9092c0a17923f4ed984456b8a5db619b0a794b3"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.17.6"},{"fixed":"7.17.24"},{"introduced":"8.4.0"},{"fixed":"8.12.0"}]}}],"versions":["v7.17.23","v7.17.22","v7.17.21","v7.17.20","v7.17.19","v7.17.18","v7.17.17","v7.17.16","v7.17.15","v7.17.14","v7.17.13","v7.17.12","v7.17.11","v7.17.10","v7.17.9","v7.17.8","v7.17.7","v7.17.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-11390.json","vanir_signatures_modified":"2026-08-12T15:15:51Z","vanir_signatures":[{"digest":{"function_hash":"119775420433353368888449704673258415513","length":469},"id":"CVE-2024-11390-04ed0c6d","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/1665f706fd9354802c02146c1e6b5c0fbcddfbc9","target":{"file":"test/test-clusters/src/main/java/org/elasticsearch/test/cluster/local/DefaultEnvironmentProvider.java","function":"get"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["252631153118237007171041294847793407275","151984004388923748600111248223214790718","148579302964524690079033955906110377205","83969663723161480770502355946479356825","11111893943075349556511057504450132701","254660440046973578497771903047837469318","302171287526990646720161932354220369100","162840583537448565816206157984972925469"],"threshold":0.9},"id":"CVE-2024-11390-2899d756","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/1665f706fd9354802c02146c1e6b5c0fbcddfbc9","target":{"file":"test/test-clusters/src/main/java/org/elasticsearch/test/cluster/local/DefaultEnvironmentProvider.java"}},{"id":"CVE-2024-11390-a20ced95","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/1665f706fd9354802c02146c1e6b5c0fbcddfbc9","target":{"file":"test/external-modules/die-with-dignity/src/javaRestTest/java/org/elasticsearch/qa/die_with_dignity/DieWithDignityIT.java"},"deprecated":false,"digest":{"line_hashes":["114875983746314892179413898728568252630","40232471339725546965955154410027233909","146656705597082492155136965235625380350","165945345971752722399723390879332786586"],"threshold":0.9}},{"source":"https://github.com/elastic/elasticsearch/commit/1665f706fd9354802c02146c1e6b5c0fbcddfbc9","target":{"file":"build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/test/rest/RestTestBasePlugin.java","function":"apply"},"deprecated":false,"digest":{"function_hash":"126401859950460619721188731901615641464","length":5193},"id":"CVE-2024-11390-ab23b0ed","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/1665f706fd9354802c02146c1e6b5c0fbcddfbc9","target":{"function":"startJcmd","file":"test/external-modules/die-with-dignity/src/javaRestTest/java/org/elasticsearch/qa/die_with_dignity/DieWithDignityIT.java"},"deprecated":false,"digest":{"length":297,"function_hash":"336977401819381689801049493485899839603"},"id":"CVE-2024-11390-bfb335ee","signature_type":"Function"},{"id":"CVE-2024-11390-c48c689a","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/fcf25fff740db6ab3ed5d145c58d70e4c3528ea7","target":{"file":"x-pack/plugin/searchable-snapshots/src/internalClusterTest/java/org/elasticsearch/xpack/searchablesnapshots/cache/full/SearchableSnapshotsPrewarmingIntegTests.java","function":"doRun"},"deprecated":false,"digest":{"function_hash":"302806869156825138967016505708747002294","length":77}},{"deprecated":false,"digest":{"line_hashes":["15728880044678428613885107089167214246","173618939874799114652410357105564381038","293761876996285912564783256243232366190","198593980507136286893931030547799247876","206709190616943257201853921897333917313","197399493388089925234224283026471881528","44508774986651643012206413574234642238","166140435195922692091311330906342127134","196437853667451077775668990843785496875","333451065704095536815766263903785873394","72868878619308445828107324034491913956"],"threshold":0.9},"id":"CVE-2024-11390-e4c81f6d","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/fcf25fff740db6ab3ed5d145c58d70e4c3528ea7","target":{"file":"x-pack/plugin/searchable-snapshots/src/internalClusterTest/java/org/elasticsearch/xpack/searchablesnapshots/cache/full/SearchableSnapshotsPrewarmingIntegTests.java"}},{"source":"https://github.com/elastic/elasticsearch/commit/fcf25fff740db6ab3ed5d145c58d70e4c3528ea7","target":{"file":"x-pack/plugin/searchable-snapshots/src/internalClusterTest/java/org/elasticsearch/xpack/searchablesnapshots/cache/full/SearchableSnapshotsPrewarmingIntegTests.java","function":"testConcurrentPrewarming"},"deprecated":false,"digest":{"function_hash":"108010166469262082174614297143144359609","length":9761},"id":"CVE-2024-11390-f406637e","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["208770898148811660317472649004368967747","77222967772934322118811833798506118124","178896071723307873887930421167283176160","147702948148653437249544830464361867437","179384613832128238157258269440206102286","93863779612561601416858181584879715864","291370154629426804295261764126694175177","291239316273735786041927222061863056561"],"threshold":0.9},"id":"CVE-2024-11390-fa6974e7","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/1665f706fd9354802c02146c1e6b5c0fbcddfbc9","target":{"file":"build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/test/rest/RestTestBasePlugin.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}