Search
Find a vulnerability
Search criteria
2 vulnerabilities found for opensearch_notifications by amazon
CVE-2022-41906 (GCVE-0-2022-41906)
Vulnerability from nvd – Published: 2022-11-11 00:00 – Updated: 2025-04-23 16:37
VLAI
EPSS
VEX
Title
OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF)
Summary
OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and prior to 2.2.1 could allow an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Notification plugin's intended scope. OpenSearch 2.2.1+ contains the fix for this issue. There are currently no recommended workarounds.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opensearch-project/notificatio… | x_refsource_CONFIRM |
| https://github.com/opensearch-project/notificatio… | x_refsource_MISC |
| https://github.com/opensearch-project/notificatio… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| opensearch-project | notifications |
Affected:
>= 2.0.0, < 2.2.1
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:56:38.599Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/opensearch-project/notifications/security/advisories/GHSA-pfc4-3436-jgrw",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/opensearch-project/notifications/security/advisories/GHSA-pfc4-3436-jgrw"
},
{
"name": "https://github.com/opensearch-project/notifications/pull/496",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/opensearch-project/notifications/pull/496"
},
{
"name": "https://github.com/opensearch-project/notifications/pull/507",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/opensearch-project/notifications/pull/507"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41906",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T15:46:40.674199Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T16:37:45.490Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "notifications",
"vendor": "opensearch-project",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and prior to 2.2.1 could allow an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Notification plugin\u0027s intended scope. OpenSearch 2.2.1+ contains the fix for this issue. There are currently no recommended workarounds. \n"
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-25T22:25:08.535Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opensearch-project/notifications/security/advisories/GHSA-pfc4-3436-jgrw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opensearch-project/notifications/security/advisories/GHSA-pfc4-3436-jgrw"
},
{
"name": "https://github.com/opensearch-project/notifications/pull/496",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opensearch-project/notifications/pull/496"
},
{
"name": "https://github.com/opensearch-project/notifications/pull/507",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opensearch-project/notifications/pull/507"
}
],
"source": {
"advisory": "GHSA-pfc4-3436-jgrw",
"discovery": "UNKNOWN"
},
"title": "OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF) "
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-41906",
"datePublished": "2022-11-11T00:00:00.000Z",
"dateReserved": "2022-09-30T00:00:00.000Z",
"dateUpdated": "2025-04-23T16:37:45.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-41906 (GCVE-0-2022-41906)
Vulnerability from cvelistv5 – Published: 2022-11-11 00:00 – Updated: 2025-04-23 16:37
VLAI
EPSS
VEX
Title
OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF)
Summary
OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and prior to 2.2.1 could allow an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Notification plugin's intended scope. OpenSearch 2.2.1+ contains the fix for this issue. There are currently no recommended workarounds.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opensearch-project/notificatio… | x_refsource_CONFIRM |
| https://github.com/opensearch-project/notificatio… | x_refsource_MISC |
| https://github.com/opensearch-project/notificatio… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| opensearch-project | notifications |
Affected:
>= 2.0.0, < 2.2.1
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:56:38.599Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/opensearch-project/notifications/security/advisories/GHSA-pfc4-3436-jgrw",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/opensearch-project/notifications/security/advisories/GHSA-pfc4-3436-jgrw"
},
{
"name": "https://github.com/opensearch-project/notifications/pull/496",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/opensearch-project/notifications/pull/496"
},
{
"name": "https://github.com/opensearch-project/notifications/pull/507",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/opensearch-project/notifications/pull/507"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41906",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T15:46:40.674199Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T16:37:45.490Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "notifications",
"vendor": "opensearch-project",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and prior to 2.2.1 could allow an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Notification plugin\u0027s intended scope. OpenSearch 2.2.1+ contains the fix for this issue. There are currently no recommended workarounds. \n"
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-25T22:25:08.535Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opensearch-project/notifications/security/advisories/GHSA-pfc4-3436-jgrw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opensearch-project/notifications/security/advisories/GHSA-pfc4-3436-jgrw"
},
{
"name": "https://github.com/opensearch-project/notifications/pull/496",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opensearch-project/notifications/pull/496"
},
{
"name": "https://github.com/opensearch-project/notifications/pull/507",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opensearch-project/notifications/pull/507"
}
],
"source": {
"advisory": "GHSA-pfc4-3436-jgrw",
"discovery": "UNKNOWN"
},
"title": "OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF) "
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-41906",
"datePublished": "2022-11-11T00:00:00.000Z",
"dateReserved": "2022-09-30T00:00:00.000Z",
"dateUpdated": "2025-04-23T16:37:45.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}