CyberRota Analysis
AI-GeneratedThe Amundsen frontend, up to version 4.3.0, is vulnerable due to improper handling of HTML in ResourceListItem components, allowing attackers to inject malicious scripts through metadata or Elasticsearch. This flaw can lead to cross-site scripting (XSS) attacks, compromising user browsers and potentially exposing sensitive data. Organizations using this version of Amundsen should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.