CVE-2026-77811: fallo de gravedad media en AWS Amazon OpenSearch Service
Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear Amazon OpenSearch Service+ Monitorear OpenSearch Dashboards dashboards-observability plugin
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.2epss 0.5%
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Productos afectados
AWS · Amazon OpenSearch ServiceOpenSearch · OpenSearch Dashboards dashboards-observability pluginCVEs relacionadas — AWS Amazon OpenSearch Service
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-18420HIGHRCE via Prototype Pollution in OpenSearch DashboardsEPSS 1.0%CVE-2026-75897HIGHUncontrolled Resource Consumption in Capabilities Route in OpenSearch DashboardsEPSS 0.7%CVE-2026-84942MEDIUMStored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch DashboardsEPSS 0.5%