CVE-2021-31828

Katalog CVE

CVSS 7.1 · High EPSS 0,89%

Kerentanan Server-Side Request Forgery (SSRF) pada amazon open distro. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

An SSRF issue in Open Distro for Elasticsearch (ODFE) before 1.13.1.0 allows an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Alerting plugin's intended scope.

Rincian

Terbit di NVD

6 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,89% peluang dieksploitasi; lebih tinggi dari 58,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/opendistro-for-elasticsearch/alerting/pull/353 patch · advisory pihak ketiga
• https://opendistro.github.io/for-elasticsearch-docs/version-history/ release notes · advisory pihak ketiga
• https://rotem-bar.com/ssrf-in-open-distro-for-elasticsearch-cve-2021-31828 advisory pihak ketiga