CVE-2024-11390

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description The issue allows for the unrestricted upload of files with dangerous types, potentially leading to arbitrary JavaScript execution in a victim's browser, resulting in a cross-site scripting (XSS) attack. This can be achieved via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app and/or have write access to the synthetics indices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.