CVE-2026-77811: falha de média gravidade em AWS Amazon OpenSearch Service
Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar Amazon OpenSearch Service+ Monitorar OpenSearch Dashboards dashboards-observability plugin
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.2epss 0.5%
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Produtos afetados
AWS · Amazon OpenSearch ServiceOpenSearch · OpenSearch Dashboards dashboards-observability pluginCVEs relacionadas — AWS Amazon OpenSearch Service
No mesmo produto, das mais perigosas para as menos.
CVE-2026-18420HIGHRCE via Prototype Pollution in OpenSearch DashboardsEPSS 1.0%CVE-2026-75897HIGHUncontrolled Resource Consumption in Capabilities Route in OpenSearch DashboardsEPSS 0.7%CVE-2026-84942MEDIUMStored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch DashboardsEPSS 0.5%