ºÚÁÏÕýÄÜÁ¿

On March 5, 2025, Elastic a security update to fix a critical vulnerability in Kibana, data visualization dashboard software. The flaw tracked as CVE-2025-25015 has a CVSS score of 9.9, highlighting its criticality.

Kibana is a data visualization tool for Elasticsearch. Elasticsearch is used in the health sector for medical record search, data management, insights, and threat detection.

The flaw, CVE-2025-25015, could allow threat actors to send specially crafted files and use specifically crafted HTTP requests to achieve arbitrary code execution. It exists due to prototype pollution and affects all Kibana versions from 8.15.0 to 8.17.3.

A prototype pollution flaw is a security issue in which threat actors can manipulate JavaScript objects and properties, potentially leading to various security issues, including remote code execution.