Skip to content
OpenAdvisories

Product · OpenSearch

security

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.4
    CVE-2023-45807

    OpenSearch Issue with tenant read-only permissions

    OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access…

    OpenSearch security org.opensearch.plugin:opensearch-security opensearch Ubuntu Maven
  • Medium 4.8
    CVE-2023-31141

    OpenSearch issue with fine-grained access control during extremely rare race conditions

    OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security a…

    OpenSearch security org.opensearch.plugin:opensearch-security opensearch Ubuntu Maven
  • Medium 5.3
    CVE-2023-25806

    Time discrepancy in authentication responses in OpenSearch

    OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issu…

    OpenSearch security org.opensearch.plugin:opensearch-security Maven
  • Medium 4.7
    CVE-2023-23612

    Issue with whitespace in JWT roles in OpenSearch

    OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are proces…

    OpenSearch security org.opensearch.plugin:opensearch-security opensearch Ubuntu Maven
  • Medium 5.7
    CVE-2023-23613

    Field-level security issue with .keyword fields in OpenSearch

    OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security (FLS) and field masking where rules written to explicitly exclude fields are not correctly applied for cer…

    OpenSearch security org.opensearch.plugin:opensearch-security opensearch Ubuntu Maven
  • Medium 6.3
    CVE-2022-41918

    Issue with fine-grained access control of indices backing data streams

    OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly appli…

    OpenSearch security org.opensearch.plugin:opensearch-security Maven