What’s Vulnerable › Vulnerabilities

CVE-2024-43794: OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-23 · updated 2026-06-17
• Weakness: CWE-601

Description

OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of the nextUrl parameter can lead to external redirect on login to OpenSearch-Dashboards for specially crafted parameters. A patch is available in 1.3.19 and 2.16.0 for this issue.

Affected products

• opensearch-project security-dashboards-plugin: before 1.3.19; from 2.0.0, < 2.16.0

References

• https://github.com/opensearch-project/security-dashboards-plugin/commit/fc4f6a27c0c80881be9e8ed6b9259a25c3fa0e13
• https://github.com/opensearch-project/security-dashboards-plugin/security/advisories/GHSA-3fph-6cqp-5mfc

Get alerted when CVE-2024-43794 or the next vulnerability affects your stack