A high-severity Cross-Site Scripting vulnerability in Elastic Kibana exposes users to potential session hijacking and unauthorized actions via malicious script execution.

This is a CWE-79 flaw regarding improper neutralization of input during web page generation. The attack vector is unauthenticated as the CVSS vector indicates no privileges are required, though it does require user interaction.

The vulnerability carries a CVSS score of 8.2, which reflects the high potential for impact on data integrity and user sessions. Successful exploitation allows an attacker to inject scripts that execute within the context of a victim's session, potentially leading to the theft of sensitive session tokens, unauthorized configuration changes, or the exfiltration of data displayed within the Kibana interface.

Immediate Action: Upgrade to Kibana versions 8.18.8, 8.19.4, 9.0.7, 9.1.4, or later, as specified in the Elastic security update ESA-2025-16.

Proactive Monitoring: Monitor web server and application access logs for suspicious URL patterns or unexpected script tags being submitted to Kibana endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict cross-site scripting filtering rules to inspect and sanitize incoming HTTP requests before they reach the Kibana instance.

Public Exploit Available: Unknown

Given the high CVSS score and the widespread nature of the affected versions, organizations should prioritize updating their Kibana installations to the latest patched versions provided by Elastic. Failure to remediate this vulnerability leaves users susceptible to persistent or reflected XSS attacks, which can be leveraged to compromise administrative sessions or sensitive business data.