Prototype Pollution CVE-2024-12556
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionNVD
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.
AnalysisAI
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.
Technical ContextAI
This vulnerability is classified as Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321), which allows attackers to modify object prototypes to inject properties affecting application logic. Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Affected products include: Elastic Kibana.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Freeze prototypes, validate object keys, avoid recursive merging of untrusted data.
More from same product – last 7 days
Blind Server-Side Request Forgery in FlaskBB's avatar URL handling allows any authenticated user to force the server to
Denial of service in Kibana allows any authenticated low-privileged user to render the Kibana service unresponsive for a
Expired access tokens in Kibana remain exploitable due to a logic error in expiration timestamp validation (CWE-672), al
Dashboard management path traversal in Elastic Kibana allows a low-privileged authenticated attacker to redirect adminis
Stored HTML injection in Kibana allows a low-privileged authenticated user with write access to an Elasticsearch index t
Share
External POC / Exploit Code
Leaving vuln.today