OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF)
CVE-2022-41906

7.7HIGH

Key Information:

Vendor

Opensearch-project

Status
Notifications
Vendor
CVE Published:
11 November 2022

What is CVE-2022-41906?

OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and prior to 2.2.1 could allow an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Notification plugin's intended scope. OpenSearch 2.2.1+ contains the fix for this issue. There are currently no recommended workarounds.

Affected Version(s)

notifications >= 2.0.0, < 2.2.1

References

https://github.com/opensearch-project/notifications/secur...
x_refsource_CONFIRM
https://github.com/opensearch-project/notifications/pull/496
x_refsource_MISC
https://github.com/opensearch-project/notifications/pull/507
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

CVSS V3.0

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.