CVE-2022-38299
An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint.
Original description
The description as published by the source.
An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint.
Affected packages
Bitnami
appsmith
[{"type":"SEMVER","events":[{"introduced":"1.7.11"},{"fixed":"1.7.12"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- patch github.com