CVE-2023-45807

OpenSearch Issue with tenant read-only permissions

Severity Score

5.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have. This issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue.

OpenSearch es un fork de código abierto impulsado por la comunidad de Elasticsearch y Kibana luego del cambio de licencia a principios de 2021. Existe un problema con la implementación de permisos de inquilinos en OpenSearch Dashboards donde los usuarios autenticados con acceso de solo lectura a un inquilino pueden realizar tareas de creación, editar y eliminar operaciones en metadatos de índice de paneles y visualizaciones en ese inquilino, lo que podría hacer que no estén disponibles. Este problema no afecta a los datos del índice, sólo a los metadatos. Dashboards aplica correctamente los permisos de solo lectura al indexar y actualizar documentos. Este problema no proporciona acceso de lectura adicional a datos que los usuarios aún no tienen. Este problema se puede mitigar deshabilitando la funcionalidad de inquilinos para el clúster. Las versiones 1.3.14 y 2.11.0 contienen una solución para este problema.

*Credits: N/A

CVSS Scores

NISTv3.1 5.4

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-10-13 CVE Reserved
2023-10-16 CVE Published
2024-09-13 CVE Updated
2024-10-22 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-281: Improper Preservation of Permissions

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://github.com/opensearch-project/security/security/advisories/GHSA-72q2-gwwf-6hrv	2023-10-20

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Amazon Search vendor "Amazon"		Opensearch Search vendor "Amazon" for product "Opensearch"				< 1.3.14.0 Search vendor "Amazon" for product "Opensearch" and version " < 1.3.14.0"		docker		Affected
Amazon Search vendor "Amazon"		Opensearch Search vendor "Amazon" for product "Opensearch"				< 1.3.14.0 Search vendor "Amazon" for product "Opensearch" and version " < 1.3.14.0"		maven		Affected
Amazon Search vendor "Amazon"		Opensearch Search vendor "Amazon" for product "Opensearch"				>= 2.0.0 < 2.11.0.0 Search vendor "Amazon" for product "Opensearch" and version " >= 2.0.0 < 2.11.0.0"		docker		Affected
Amazon Search vendor "Amazon"		Opensearch Search vendor "Amazon" for product "Opensearch"				>= 2.0.0 < 2.11.0.0 Search vendor "Amazon" for product "Opensearch" and version " >= 2.0.0 < 2.11.0.0"		maven		Affected