CVE-2024-12556
CRITICALCVSS 9.8/10EPSS 0.41%
Last modified
CVE-2024-12556 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.. EPSS estimates a 0.41% chance of exploitation in the next 30 days.
Description
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Kibana | >= 8.16.1, < 8.16.4 |
| Elastic | Kibana | >= 8.17.0, < 8.17.2 |
References
- https://discuss.elastic.co/t/kibana-8-16-4-and-8-17-2-security-update-esa-2025-02/376918Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-12556?
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.
How severe is CVE-2024-12556?
CVE-2024-12556 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.41% probability of exploitation in the next 30 days.
How do I fix CVE-2024-12556?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-12550Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds…7.8
- CVE-2024-12551Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds…7.8
- CVE-2024-12552Wacom Center WTabletServicePro Link Following Local Privileg…7.8
- CVE-2024-12553GeoVision GV-ASManager Missing Authorization Information Dis…6.5
- CVE-2024-12554The Peter’s Custom Anti-Spam plugin for WordPress is vulnera…5.4
- CVE-2024-12555The SIP Calculator plugin for WordPress is vulnerable to Cro…6.1
- CVE-2024-12557The Transporters.io plugin for WordPress is vulnerable to Cr…6.1
- CVE-2024-12558The WP BASE Booking of Appointments, Services and Events plu…6.5
- CVE-2024-12559The ClickDesigns plugin for WordPress is vulnerable to unaut…5.3
- CVE-2024-1256A vulnerability was found in Jspxcms 10.2.0 and classified a…4.3
- CVE-2024-12560The Button Block – Get fully customizable & multi-functional…6.5
- CVE-2024-12561The Affiliate Sales in Google Analytics and other tools plug…6.1
Are you affected by CVE-2024-12556?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST