This vulnerability in Elastic Kibana arises from insufficient sanitization of user-supplied input when generating web pages, allowing stored cross-site scripting (XSS) attacks. Specifically, a user with write permissions to an Elasticsearch index can insert malicious HTML markup that persists and is rendered in Kibana views accessed by other users. The vulnerability could enable attackers to manipulate the Kibana user interface and cause the victim's browser to issue unauthorized outbound network requests. The CVSS 3.1 base score is 4.1, indicating medium severity, with attack vector network, low attack complexity, requiring privileges and user interaction, and impacting integrity but not confidentiality or availability. Affected versions include Kibana 8.0.0 and 9.0.0. No patch or official remediation level has been published as of the data provided.

Successful exploitation allows an attacker with write access to an Elasticsearch index to persist malicious HTML content that executes in the context of other users viewing Kibana dashboards or views. This can lead to unauthorized manipulation of the Kibana user interface and the execution of outbound network requests from the victim's browser session. The vulnerability impacts data integrity and user interface trust but does not directly compromise confidentiality or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should restrict write access to Elasticsearch indices to trusted users only and monitor for unusual UI behavior in Kibana. Avoid exposing Kibana dashboards to untrusted users until a patch or official mitigation is available.