Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Critical Vulnerability in Elastic Kibana

7 March 2025

Elastic has released security updates addressing a critical vulnerability affecting their Kibana software. Users and administrators of affected products are advised to update to the latest versions immediately.

Elastic has released security updates addressing a critical vulnerability (CVE-2025-25015) affecting their Kibana software. The vulnerability has a Common Vulnerability Scoring System (CVSSv3.1) score of 9.9 out of 10.

Successful exploitation of the prototype pollution vulnerability in the Kibana could allow an attacker to manipulate an application's JavaScript objects and properties, potentially leading to unauthorised data access, privilege escalation, denial-of-service, or remote code execution. 

The vulnerability affects all versions of Kibana before version 8.17.3.

Users and administrators of the affected products are advised to update to the latest version immediately. In the event that immediate patching is not an option, users are recommended to set the Integration Assistant feature flag to false ("xpack.integration_assistant.enabled: false") in Kibana's configuration ("kibana.yml").

More information is available here:

https://discuss.elastic.co/t/kibana-8-17-3-security-update-esa-2025-06/375441 (opens in new tab)

https://thehackernews.com/2025/03/elastic-releases-urgent-fix-for.html (opens in new tab)