CVE-2025-25012

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
Elastic	Kibana	>= 7.0.0, <= 7.17.28; >= 8.0.0, <= 8.17.7; >= 8.18.0, <= 8.18.2; >= 9.0.0, <= 9.0.2

References

https://discuss.elastic.co/t/kibana-7-17-29-8-17-8-8-18-3-9-0-3-security-update-esa-2025-10/379444Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Jun 25, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-250136.5Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens vi CVE-2025-250149.8A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting CVE-2025-250159.9Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana CVE-2025-250164.3Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file d CVE-2025-250176.1Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)CVE-2025-250185.4Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)CVE-2025-250196.5IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session a CVE-2025-25027.8An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.CVE-2025-250206.5IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated CVE-2025-250217.2IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a privileged exec CVE-2025-250228.8IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticate CVE-2025-250234.9IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment.