Elastic Kibana CVE-2025-25018

Requires an authenticated Kibana account with privileges to write persistent/stored content (saved objects, dashboards, or similar fields that Kibana later renders), consistent with PR:L. The stored payload only executes when a second user - typically a higher-privileged operator - views the affected page, matching UI:R; it is not a self-triggering or fully unauthenticated flaw. Limiting factors: attacker must already have valid authenticated access to inject the payload, a victim must actively view the malicious content, and impact is confined to low confidentiality/integrity in the victim's browser context (no availability impact). Affected versions are Kibana releases prior to the 8.18.8 / 8.19.5 / 9.0.8 / 9.1.5 fixes per Elastic advisory ESA-2025-17.

This is a moderate-severity stored XSS (CVSS 5.4) that is NOT a top-tier priority but should be patched in routine cycles. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) tells a coherent story: network-reachable, low complexity, but requiring authenticated privileges (PR:L) to plant the payload AND victim interaction (UI:R) to fire it, with only low confidentiality and integrity impact and no availability impact. The scope change (S:C) reflects that injected script executes in another user's browser/session context - the one genuinely aggravating factor. Exploitation signals are weak-to-absent: EPSS is 0.23% (13th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data. All signals are consistent here - low EPSS, no KEV, no POC, and a modest CVSS all point to a real-but-low-urgency issue rather than a widespread-exploitation emergency. The main caveat is that stored XSS in a widely deployed admin/analytics console (Kibana) can be leveraged for privilege escalation or session theft against higher-privileged operators, so impact in a specific environment may exceed the base CVSS.

A low-privileged but authenticated Kibana user injects a malicious script into a field that Kibana stores and later renders without proper neutralization (e.g., a dashboard, saved object, or annotation). When a higher-privileged operator subsequently views that content, the script executes in their authenticated session, enabling session/token theft or actions on their behalf. No public exploit code was identified at time of analysis, and successful exploitation depends on the victim viewing the attacker-controlled content.