CVE-2022-41906

HIGH

OpenSearch Notifications < 2.2.1.0 - Server-Side Request Forgery via HTTP Requests

Title source: llm
STIX 2.1

Description

OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and prior to 2.2.1 could allow an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Notification plugin's intended scope. OpenSearch 2.2.1+ contains the fix for this issue. There are currently no recommended workarounds.

References (3)

Core 3
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/opensearch-project/notifications/pull/496
Patch, Third Party Advisory x_refsource_misc
https://github.com/opensearch-project/notifications/pull/507

Scores

CVSS v3 8.7
EPSS 0.0040
EPSS Percentile 60.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-918
Status published
Products (1)
amazon/opensearch_notifications < 2.2.1.0
Published Nov 11, 2022
Tracked Since Feb 18, 2026