CVEvulnerability
CVE-2021-31828
7.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-05-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:N
- Weaknesses
- CWE-918
Description
An SSRF issue in Open Distro for Elasticsearch (ODFE) before 1.13.1.0 allows an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Alerting plugin's intended scope.
Affected configurations
• amazon open distro (< 1.13.1.0)
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://github.com/opendistro-for-elasticsearch/alerting/pull/353 Patch, Third Party Advisory
- https://opendistro.github.io/for-elasticsearch-docs/version-history/ Release Notes, Third Party Advisory
- https://rotem-bar.com/ssrf-in-open-distro-for-elasticsearch-cve-2021-31828 Third Party Advisory
- https://github.com/opendistro-for-elasticsearch/alerting/pull/353 Patch, Third Party Advisory
- https://opendistro.github.io/for-elasticsearch-docs/version-history/ Release Notes, Third Party Advisory
- https://rotem-bar.com/ssrf-in-open-distro-for-elasticsearch-cve-2021-31828 Third Party Advisory