« Volver al listado

CVE-2023-45807

Estado: ModificadaMedia (5.4)—

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents.

Leer descripción completaMostrar menos

This issue does not provide additional read access to data users don’t already have. This issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Amazon — Opensearch

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-45807",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-45807",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-13T18:58:24.627153Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "opensearch-project",
          "product": "security",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.3.14.0"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0.0, < 2.11.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-10-16T22:15:12.790",
  "references": [
    {
      "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-72q2-gwwf-6hrv",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-72q2-gwwf-6hrv",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-281"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have. This issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue."
    },
    {
      "lang": "es",
      "value": "OpenSearch es un fork de código abierto impulsado por la comunidad de Elasticsearch y Kibana luego del cambio de licencia a principios de 2021. Existe un problema con la implementación de permisos de inquilinos en OpenSearch Dashboards donde los usuarios autenticados con acceso de solo lectura a un inquilino pueden realizar tareas de creación, editar y eliminar operaciones en metadatos de índice de paneles y visualizaciones en ese inquilino, lo que podría hacer que no estén disponibles. Este problema no afecta a los datos del índice, sólo a los metadatos. Dashboards aplica correctamente los permisos de solo lectura al indexar y actualizar documentos. Este problema no proporciona acceso de lectura adicional a datos que los usuarios aún no tienen. Este problema se puede mitigar deshabilitando la funcionalidad de inquilinos para el clúster. Las versiones 1.3.14 y 2.11.0 contienen una solución para este problema."
    }
  ],
  "lastModified": "2026-06-17T06:29:33.777",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:amazon:opensearch:*:*:*:*:*:docker:*:*",
              "vulnerable": true,
              "matchCriteriaId": "242C9ADA-A2B2-4FBE-BB25-2A3389572290",
              "versionEndExcluding": "1.3.14.0"
            },
            {
              "criteria": "cpe:2.3:a:amazon:opensearch:*:*:*:*:*:maven:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E5DD7C0-C800-47F6-8A3D-F539F8E74015",
              "versionEndExcluding": "1.3.14.0"
            },
            {
              "criteria": "cpe:2.3:a:amazon:opensearch:*:*:*:*:*:docker:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1F3994F-21EE-4DA8-9C00-65AC4BC0BA8E",
              "versionEndExcluding": "2.11.0.0",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:amazon:opensearch:*:*:*:*:*:maven:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94EFD1AD-102F-4E21-9E1A-0CE30CB17A25",
              "versionEndExcluding": "2.11.0.0",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}