CVE-2022-41906

2022-11-1119:15:11

CWE-918

[email protected]

web.nvd.nist.gov

cve-2022-41906

opensearch

notifications plugin

ssrf

vulnerability

security advisory

nvd

cve

8.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.6%

JSON

OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and prior to 2.2.1 could allow an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Notification plugin’s intended scope. OpenSearch 2.2.1+ contains the fix for this issue. There are currently no recommended workarounds.

Affected configurations

Vulners

NVD

Node

opensearch-projectnotificationsRange2.0.0–2.2.1

CPENameOperatorVersion
amazon:opensearch_notificationsamazon opensearch notificationslt2.2.1.0

CPE	Name	Operator	Version
amazon:opensearch_notifications	amazon opensearch notifications	lt	2.2.1.0

CNA Affected

[
  {
    "vendor": "opensearch-project",
    "product": "notifications",
    "versions": [
      {
        "version": ">= 2.0.0, < 2.2.1",
        "status": "affected"
      }
    ]
  }
]