Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-45807— OpenSearch Issue with tenant read-only permissions

Quick assessment

Affected
opensearch-project security
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenSearch Project是OpenSearch Project开源的一个社区驱动的、Apache 2.0许可的开放源代码搜索和分析套件。使其易于获取、搜索、可视化和分析数据。 OpenSearch存在安全漏洞。攻击者利用该漏洞可以执行创建、编辑和删除操作。

CVSS 5.4 · Medium EPSS 0.41% · P33

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-45807

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenSearch Issue with tenant read-only permissions
Source: CVE Program / CVE List V5
Vulnerability Description
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have. This issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
权限预留不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
OpenSearch Project 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenSearch Project是OpenSearch Project开源的一个社区驱动的、Apache 2.0许可的开放源代码搜索和分析套件。使其易于获取、搜索、可视化和分析数据。 OpenSearch存在安全漏洞。攻击者利用该漏洞可以执行创建、编辑和删除操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
opensearch-project security < 1.3.14.0 -

II. Public POCs for CVE-2023-45807

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-45807

请登录查看更多情报信息。

Vendor Advisories for CVE-2023-45807 (1)

IV. Related Vulnerabilities

Same product: security
Same vendor: opensearch-project
Same weakness: CWE-281

V. Comments for CVE-2023-45807

No comments yet

Leave a comment