Elastic Kibana CVE-2025-25009

Exploitation requires an authenticated account with privileges to upload file attachments to the Kibana Cases feature (PR:L), and the stored payload only executes when a second user opens the affected case in their browser (UI:R) - so it depends on the Cases feature being in use and on victim interaction. Limiting factors: the attacker cannot act unauthenticated; impact is confined to the viewing user's browser session and their Kibana privilege level (C:L/I:L/A:N); and deployments not using Cases/case file uploads are not exposed. No special non-default server configuration is otherwise indicated beyond use of the Cases functionality.

This is a moderate-severity stored XSS (CVSS 5.4, CWE-79) that scores accurately rather than being inflated. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N shows the realistic constraints: PR:L means an authenticated Kibana user is required to plant the payload, and UI:R means a victim must subsequently view the malicious case file for the script to fire - so this is not a point-and-click remote takeover. The scope change (S:C) correctly reflects that injected script executes in a victim's browser context, distinct from the Kibana server component. Exploitation signals are consistently low-to-moderate: EPSS is 0.24% (14th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data - so this is no public exploit identified at time of analysis. The low/low/none confidentiality-integrity-availability impacts limit blast radius to session-level actions (token/cookie theft, actions-as-victim, data disclosure within the victim's Kibana privileges) rather than full compromise. Net: a legitimate patch-management priority for Kibana operators because it is network-reachable and affects a widely deployed product, but not an emergency given the authentication requirement, required user interaction, absence of KEV/POC, and low EPSS. No signals conflict with one another here.

An authenticated Kibana user with permission to create or modify Cases uploads a file crafted to carry a malicious script payload to a case. When an analyst, SOC operator, or administrator later opens that case, the stored script executes in their browser session, enabling actions such as session/token theft or performing requests with the victim's Kibana privileges. No public proof-of-concept was provided, and the attack requires both low-privilege authentication (PR:L) and victim interaction (UI:R).