Kibana Prototype Pollution Permits Code Exec via Unrestricted Upload & Path Trv
CVE-2024-12556 Published on April 8, 2025
Kibana Prototype Pollution can lead to code injection
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.
Vulnerability Analysis
CVE-2024-12556 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a Prototype Pollution Vulnerability?
The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVE-2024-12556 has been classified to as a Prototype Pollution vulnerability or weakness.
Products Associated with CVE-2024-12556
Want to know whenever a new CVE is published for Elastic Kibana? stack.watch will email you.
Affected Versions
Elastic Kibana:- Version 8.16.1 and below 8.17.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.