Products
OpenSearch Observability
- 2.14
Source
security-advisories@github.com
Tags
CVE-2024-39901 details
Published : July 9, 2024, 10:15 p.m.
Last Modified : July 9, 2024, 10:15 p.m.
Last Modified : July 9, 2024, 10:15 p.m.
Description
OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.
CVSS Score
| 1 | 2 | 3 | 4 | 5.4 | 6 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Base Score
5.4
Exploitability Score
2.8
Impact Score
2.5
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
| URL | Source |
|---|---|
| https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e | security-advisories@github.com |
| https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33 | security-advisories@github.com |
| https://opensearch.org/versions/opensearch-2-14-0.html | security-advisories@github.com |
This website uses the NVD API, but is not approved or certified by it.