// For flags

CVE-2022-41918

Issue with fine-grained access control of indices backing data streams

Severity Score

6.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue.

OpenSearch es un fork de código abierto impulsado por la comunidad de Elasticsearch y Kibana. Existe un problema con la implementación de reglas de control de acceso detalladas (seguridad a nivel de documento, seguridad a nivel de campo y enmascaramiento de campo) donde no se aplican correctamente a los índices que respaldan los flujos de datos que potencialmente conducen a una autorización de acceso incorrecta. OpenSearch 1.3.7 y 2.4.0 contienen un parche para este problema. Se recomienda a los usuarios que actualicen. No se conocen workarounds para este problema.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-30 CVE Reserved
  • 2022-11-15 CVE Published
  • 2024-06-07 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-612: Improper Authorization of Index Containing Sensitive Information
  • CWE-863: Incorrect Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Amazon
Search vendor "Amazon"
Opensearch
Search vendor "Amazon" for product "Opensearch"
< 1.3.7
Search vendor "Amazon" for product "Opensearch" and version " < 1.3.7"
docker
Affected
Amazon
Search vendor "Amazon"
Opensearch
Search vendor "Amazon" for product "Opensearch"
>= 2.0.0 < 2.4.0
Search vendor "Amazon" for product "Opensearch" and version " >= 2.0.0 < 2.4.0"
docker
Affected