{"id":"CVE-2024-12556","summary":"Kibana Prototype Pollution can lead to code injection","details":"Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.","aliases":["BIT-elk-2024-12556","BIT-kibana-2024-12556"],"modified":"2026-08-12T14:51:59.323649Z","published":"2025-04-08T20:04:22.103Z","database_specific":{"cwe_ids":["CWE-1321"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12556.json","cna_assigner":"elastic"},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/kibana-8-16-4-and-8-17-2-security-update-esa-2025-02/376918"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12556.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12556"},{"type":"PACKAGE","url":"https://github.com/elastic/kibana"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"ffe992aa682c1968b5df375b5095b3a21f122bf3"},{"fixed":"3a298fc72352e1b1be92b6619c29d875d64df820"},{"introduced":"2b6a7fed44faa321997703718f07ee0420804b41"},{"fixed":"747663ddda3421467150de0e4301e8d4bc636b0c"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"8.16.1"},{"fixed":"8.16.4"},{"introduced":"8.17.0"},{"fixed":"8.17.2"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"c8b46e87c4d61de4fe046ce5ea0a0b68aad5acf9"},{"fixed":"4d74e2c041a2e9b7c6cefe20d106cde5f3d2439c"},{"introduced":"86cbc85e621f4f3f701ed230f4e859ac5a80145b"},{"fixed":"d7985c80643203de533d99844eb1b53cae85f8f9"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"8.16.1"},{"fixed":"8.16.4"},{"introduced":"8.17.0"},{"fixed":"8.17.2"}],"source":"CPE_RANGE"}}],"versions":["v8.17.1","v8.16.3","v8.17.0","v8.16.2","v8.16.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12556.json","vanir_signatures_modified":"2026-08-12T14:51:59Z","vanir_signatures":[{"digest":{"function_hash":"263356833667147417207880542417020229118","length":346},"id":"CVE-2024-12556-19a84879","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/747663ddda3421467150de0e4301e8d4bc636b0c","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/ObjectMapper.java","function":"setIgnoredValues"},"deprecated":false},{"target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/IgnoredSourceFieldMapperTests.java"},"deprecated":false,"digest":{"line_hashes":["168799588092401371349937989380744438042","242259272325545759304556204886294254385","78134022479182254435201794946905021050"],"threshold":0.9},"id":"CVE-2024-12556-b11c30a6","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/747663ddda3421467150de0e4301e8d4bc636b0c"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/747663ddda3421467150de0e4301e8d4bc636b0c","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/ObjectMapper.java"},"deprecated":false,"digest":{"line_hashes":["241650658189941592068922497856645279704","245410000860545525443509860004509825878","289885912327545093624921847601875478957","56515432158717916672434292238886754568"],"threshold":0.9},"id":"CVE-2024-12556-c2961f10"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"}]}