CVE-2022-41918
Issue with fine-grained access control of indices backing data streams
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue.
OpenSearch es un fork de código abierto impulsado por la comunidad de Elasticsearch y Kibana. Existe un problema con la implementación de reglas de control de acceso detalladas (seguridad a nivel de documento, seguridad a nivel de campo y enmascaramiento de campo) donde no se aplican correctamente a los índices que respaldan los flujos de datos que potencialmente conducen a una autorización de acceso incorrecta. OpenSearch 1.3.7 y 2.4.0 contienen un parche para este problema. Se recomienda a los usuarios que actualicen. No se conocen workarounds para este problema.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-09-30 CVE Reserved
- 2022-11-15 CVE Published
- 2024-06-07 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-612: Improper Authorization of Index Containing Sensitive Information
- CWE-863: Incorrect Authorization
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4 | 2023-06-27 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Amazon Search vendor "Amazon" | Opensearch Search vendor "Amazon" for product "Opensearch" | < 1.3.7 Search vendor "Amazon" for product "Opensearch" and version " < 1.3.7" | docker |
Affected
| ||||||
Amazon Search vendor "Amazon" | Opensearch Search vendor "Amazon" for product "Opensearch" | >= 2.0.0 < 2.4.0 Search vendor "Amazon" for product "Opensearch" and version " >= 2.0.0 < 2.4.0" | docker |
Affected
|