LiveActive security incident?Get immediate response
CVE Record

CVE-2021-31828: An SSRF issue in Open Distro for Elasticsearch (ODFE) before 1.13.1.0 allows an existing privileged user to...

An SSRF issue in Open Distro for Elasticsearch (ODFE) before 1.13.1.0 allows an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Alerting plugin's intended scope.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-31828 is a server-side request forgery issue in Open Distro for Elasticsearch before 1.13.1.0. A privileged existing user could make the Alerting plugin send HTTP requests beyond its intended scope, potentially probing internal services or interacting with configured resources.

Executive priority

Treat as a targeted internal-risk issue, not a broad unauthenticated emergency. Prioritize remediation for clusters with privileged shared accounts, sensitive internal networks, or outdated ODFE releases.

Technical view

The flaw affects ODFE Alerting before 1.13.1.0. It allows an authenticated privileged user to abuse Alerting HTTP request behavior outside expected boundaries. The public record does not provide CVSS, CWE, detailed affected CPEs, or confirmed exploitation in the wild.

Likely exposure

Exposure is most likely in deployments still running Open Distro for Elasticsearch before 1.13.1.0 with the Alerting plugin enabled and privileged users able to configure alerting actions.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation evidence. A public researcher write-up and upstream pull request exist, so defenders should assume the issue is publicly known.

Researcher notes

Evidence is incomplete: no CVSS vector, CWE mapping, CPE list, or KEV status is provided. Analysis should stay bounded to ODFE before 1.13.1.0 and the Alerting plugin SSRF behavior described by the CVE sources.

Mitigation direction

  • Upgrade Open Distro for Elasticsearch and Alerting to 1.13.1.0 or later.
  • Review vendor version history for the exact fixed release path.
  • Restrict privileged Alerting access to trusted administrators only.
  • Limit outbound network access from Elasticsearch nodes where operationally possible.
  • Review configured Alerting destinations and remove unnecessary HTTP targets.

Validation and detection

  • Inventory Open Distro for Elasticsearch versions across all clusters.
  • Confirm whether the Alerting plugin is installed and enabled.
  • List users or roles allowed to create or modify alerts.
  • Review Alerting configurations for unexpected HTTP destinations.
  • Check Elasticsearch and network logs for unusual internal HTTP requests.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Cloud metadata behavior lookup

The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-31828 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.