Description
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AWS | OpenSearch | 2.4 – ≤ 3.5 | — |
| Github | OpenSearch | 2.4.0 – ≤ 2.19.5, 3.0.0 – ≤ 3.7.0 | — |