Kibana CVE-2025-25017

Exploitation requires an attacker to get attacker-controlled input rendered by Kibana's web UI without proper neutralization (CWE-79), and critically requires user interaction (CVSS UI:R): a logged-in Kibana user must open the crafted link or view the page containing the injected payload. The limiting factors that reduce real-world risk are this mandatory victim interaction, the fact that impact is confined to the victim's browser/session (S:C, C:L/I:L, A:N - no direct server compromise or availability loss), and that the exact feature or input field required to trigger injection is not specified in the available description, so defenders should consult the Elastic advisory to identify the vulnerable component. The description does not state that any non-default configuration is required.

This is a moderate, not a priority, issue. The CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects a classic reflected/stored XSS: network-reachable and unauthenticated to trigger, but gated by required user interaction (UI:R), with only Low confidentiality and integrity impact and a scope change (S:C) because script executes in the victim's browser context rather than on the Kibana server itself. Exploitation signals are weak and mutually consistent: EPSS is only 0.27% (18th percentile), there is no CISA KEV listing, and no public exploit has been identified in the provided data - so there is no evidence of active or imminent widespread exploitation. The one real amplifier is prevalence: Kibana is a heavily deployed component of the Elastic/ELK observability stack, so a working exploit could affect many organizations, but the low EPSS and absence of POC keep realistic near-term risk modest. No data is internally conflicting; the main gap is that the single Elastic advisory reference was not retrieved in this analysis, so the exact affected/fixed version boundaries are not independently confirmed here.

An attacker crafts a malicious Kibana URL or injects a payload into a field that Kibana later renders without proper neutralization, then lures an authenticated Kibana user (e.g. an analyst or admin) into viewing it. When the page loads, attacker-controlled JavaScript executes in the victim's browser session, allowing theft of session context or actions in the Kibana UI as that user. No public exploit code is identified at time of analysis, and success depends on the victim interacting with the crafted content.