Riskcovery

CVE-2025-25012

Kibana Open Redirect

State
Published
Severity
4.3 Medium
Published
Jun 25, 2025
Updated
Jun 25, 2025
Reserved
Jan 31, 2025

Read the record on cve.org

Description

URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nelastic

Weaknesses

  • CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

ProductVersions
KibanaElastic
  • 7.0.0 through 7.17.28Affected
  • 8.0.0 through 8.17.7Affected
  • 8.18.0 through 8.18.2Affected
  • 9.0.0 through 9.0.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.