Back to Database
Status published
Medium
CVE-2024-43794
OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect
Vulnerability Description
OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of the nextUrl parameter can lead to external redirect on login to OpenSearch-Dashboards for specially crafted parameters. A patch is available in 1.3.19 and 2.16.0 for this issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-43794
Credits & Attribution
No credits recorded in the NVD database.
References
More from opensearch-project
View All →CVE-2025-62371
OpenSearch Data Prepper plugins trusts all SSL certificates by default
High
7.4
CVE-2024-55886
OpenTelemetry Logs source may lack authentication with some custom plugins
Medium
6.9
CVE-2024-39901
OpenSearch Observability does not properly restrict access to private tenant resources
Medium
4.2
CVE-2024-39900
OpenSearch Dashboards Reports does not properly restrict access to private tenant resources
Medium
5.4
CVE-2023-45807
OpenSearch Issue with tenant read-only permissions
Medium
5.4
Affected Vendor
opensearch-project
View all reports →Affected Software
security-dashboards-plugin
Vulnerable Versions:
< 1.3.19, >= 2.0.0, < 2.16.0
Timeline
Official Publish:
August 23rd, 2024
Last Modified:
August 23rd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N