Description (CNA)
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| AWS / Amazon OpenSearch Service | unaffected 0 before 3.3 |
| OpenSearch / OpenSearch Dashboards dashboards-observability plugin | affected 0 before 3.4; affected 0 before 2.19.6 |
CWE
CWE-79
References
- https://opensearch.org/artifacts/by-version/#release-3-4-0
- https://opensearch.org/artifacts/by-version/#release-2-19-6
- https://aws.amazon.com/security/security-bulletins/2026-088-aws/
- https://github.com/opensearch-project/dashboards-observability/security/advisories/GHSA-rmqx-r3wm-3px5
ADP enrichment
No English description supplied.
No references supplied.