CVE-2024-12556: Kibana Prototype Pollution can lead to code injection
Published Apr 8, 2025
·Updated
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.
Affected Software
3 affected components
Elastic Kibana
Elastic Kibana>=8.16.1<8.16.4
Elastic Kibana>=8.17.0<8.17.2
Remediation
Event History
Apr 8, 2025
CVE Published
via MITRE·08:04 PM
Data Sourced
via MITRE·08:04 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-12556?
CVE-2024-12556 has a high severity rating due to its potential for code injection and prototype pollution.
2
How do I fix CVE-2024-12556?
To mitigate CVE-2024-12556, ensure you are using the latest version of Kibana and implement proper file upload validation.
3
What versions of Kibana are affected by CVE-2024-12556?
CVE-2024-12556 affects multiple versions of Kibana prior to the latest security patches.
4
What are the potential impacts of CVE-2024-12556?
Exploitation of CVE-2024-12556 can lead to unauthorized code execution through unvalidated file uploads.
5
Is there a workaround for CVE-2024-12556?
Implementing strict input validation and file handling can serve as a temporary workaround for CVE-2024-12556.