Vulnerability-Lookup

CVE-2022-41918 (GCVE-0-2022-41918)

Vulnerability from cvelistv5 – Published: 2022-11-15 00:00 – Updated: 2025-04-23 16:37

Title

Issue with fine-grained access control of indices backing data streams

Summary

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 13:54 UTC

CWE

CWE-863 - Incorrect Authorization
CWE-612 - Improper Authorization of Index Containing Sensitive Information

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7674 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/opensearch-project/security/se…
https://github.com/opensearch-project/security/co…

Impacted products

1 product

Vendor	Product	Version	CPE status
opensearch-project	security	Affected: <1.3.7 Affected: >= 2.0.0, < 2.4.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:56:38.553Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-41918",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:54:27.350734Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:37:15.154Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "security",
          "vendor": "opensearch-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c1.3.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-612",
              "description": "CWE-612: Improper Authorization of Index Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-15T00:00:00.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg"
        },
        {
          "url": "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4"
        }
      ],
      "source": {
        "advisory": "GHSA-wmx7-x4jp-9jgg",
        "discovery": "UNKNOWN"
      },
      "title": "Issue with fine-grained access control of indices backing data streams"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-41918",
    "datePublished": "2022-11-15T00:00:00.000Z",
    "dateReserved": "2022-09-30T00:00:00.000Z",
    "dateUpdated": "2025-04-23T16:37:15.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-41918",
      "date": "2026-10-22",
      "epss": "0.00484",
      "percentile": "0.40706"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "security",
                "vendor": "opensearch-project",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c1.3.7"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.0.0, \u003c 2.4.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:amazon:opensearch:*:*:*:*:*:docker:*:*",
                    "matchCriteriaId": "3AE6AA88-66C6-447C-A162-6C81F4C0F471",
                    "versionEndExcluding": "1.3.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:amazon:opensearch:*:*:*:*:*:docker:*:*",
                    "matchCriteriaId": "75AA1A9B-34D6-4E1F-A746-1A5DA518B4C4",
                    "versionEndExcluding": "2.4.0",
                    "versionStartIncluding": "2.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue."
          },
          {
            "lang": "es",
            "value": "OpenSearch es un fork de c\u00f3digo abierto impulsado por la comunidad de Elasticsearch y Kibana. Existe un problema con la implementaci\u00f3n de reglas de control de acceso detalladas (seguridad a nivel de documento, seguridad a nivel de campo y enmascaramiento de campo) donde no se aplican correctamente a los \u00edndices que respaldan los flujos de datos que potencialmente conducen a una autorizaci\u00f3n de acceso incorrecta. OpenSearch 1.3.7 y 2.4.0 contienen un parche para este problema. Se recomienda a los usuarios que actualicen. No se conocen workarounds para este problema."
          }
        ],
        "id": "CVE-2022-41918",
        "lastModified": "2026-06-17T05:04:03.653",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-41918",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:54:27.350734Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2022-11-15T23:15:28.283",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-612"
              },
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-29T02:40:37+00:00",
      "cve": "CVE-2022-41918",
      "id": "CVE-2022-41918",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Issue with fine-grained access control of indices backing data streams",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-41918.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T12:56:38.553Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-41918",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-04-23T13:54:27.350734Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-04-23T13:54:29.308Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "security",
              "vendor": "opensearch-project",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c1.3.7"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.0.0, \u003c 2.4.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-612",
                  "description": "CWE-612: Improper Authorization of Index Containing Sensitive Information",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2022-11-15T00:00:00.000Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg"
            },
            {
              "url": "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4"
            }
          ],
          "source": {
            "advisory": "GHSA-wmx7-x4jp-9jgg",
            "discovery": "UNKNOWN"
          },
          "title": "Issue with fine-grained access control of indices backing data streams"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2022-41918",
        "datePublished": "2022-11-15T00:00:00.000Z",
        "dateReserved": "2022-09-30T00:00:00.000Z",
        "dateUpdated": "2025-04-23T16:37:15.154Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2022-41918

Vulnerability from fkie_nvd - Published: 2022-11-15 23:15 - Updated: 2026-06-17 05:04

Severity

6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg	Third Party Advisory

Impacted products

	Vendor	Product	Version
	amazon	opensearch	*
	amazon	opensearch	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "security",
          "vendor": "opensearch-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c1.3.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.4.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:amazon:opensearch:*:*:*:*:*:docker:*:*",
              "matchCriteriaId": "3AE6AA88-66C6-447C-A162-6C81F4C0F471",
              "versionEndExcluding": "1.3.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:amazon:opensearch:*:*:*:*:*:docker:*:*",
              "matchCriteriaId": "75AA1A9B-34D6-4E1F-A746-1A5DA518B4C4",
              "versionEndExcluding": "2.4.0",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue."
    },
    {
      "lang": "es",
      "value": "OpenSearch es un fork de c\u00f3digo abierto impulsado por la comunidad de Elasticsearch y Kibana. Existe un problema con la implementaci\u00f3n de reglas de control de acceso detalladas (seguridad a nivel de documento, seguridad a nivel de campo y enmascaramiento de campo) donde no se aplican correctamente a los \u00edndices que respaldan los flujos de datos que potencialmente conducen a una autorizaci\u00f3n de acceso incorrecta. OpenSearch 1.3.7 y 2.4.0 contienen un parche para este problema. Se recomienda a los usuarios que actualicen. No se conocen workarounds para este problema."
    }
  ],
  "id": "CVE-2022-41918",
  "lastModified": "2026-06-17T05:04:03.653",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-41918",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-04-23T13:54:27.350734Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2022-11-15T23:15:28.283",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-612"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-WMX7-X4JP-9JGG

Vulnerability from github – Published: 2023-03-07 20:04 – Updated: 2023-03-07 20:04

Summary

OpenSearch has issue with fine-grained access control of indices backing data streams

Details

Impact

There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. This issue can only be triggered by authenticated users authorized to read those data streams which are backed by the impacted indexes. Additionally, existing privileged users cannot access random indexes within these clusters; they can only access indexes to which they have already been granted permission.

Patches

OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue.

Workarounds

There is no recommended work around.

For more information

If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.opensearch.plugin:opensearch-security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.opensearch.plugin:opensearch-security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-41918"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-612",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-07T20:04:42Z",
    "nvd_published_at": "2022-11-15T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThere is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. This issue can only be triggered by authenticated users authorized to read those data streams which are backed by the impacted indexes. Additionally, existing privileged users cannot access random indexes within these clusters; they can only access indexes to which they have already been granted permission.\n\n### Patches\nOpenSearch 1.3.7 and 2.4.0 contain a fix for this issue.\n\n### Workarounds\nThere is no recommended work around.\n\n### For more information\nIf you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.\n",
  "id": "GHSA-wmx7-x4jp-9jgg",
  "modified": "2023-03-07T20:04:42Z",
  "published": "2023-03-07T20:04:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41918"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/opensearch-project/security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenSearch has issue with fine-grained access control of indices backing data streams"
}

GSD-2022-41918

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-41918

Aliases

CVE-2022-41918

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-41918",
    "id": "GSD-2022-41918"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-41918"
      ],
      "details": "OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue.",
      "id": "GSD-2022-41918",
      "modified": "2023-12-13T01:19:33.172650Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-41918",
        "STATE": "PUBLIC",
        "TITLE": "Issue with fine-grained access control of indices backing data streams"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "security",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c1.3.7"
                        },
                        {
                          "version_value": "\u003e= 2.0.0, \u003c 2.4.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "opensearch-project"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-863: Incorrect Authorization"
              }
            ]
          },
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-612: Improper Authorization of Index Containing Sensitive Information"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg",
            "refsource": "CONFIRM",
            "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg"
          },
          {
            "name": "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4",
            "refsource": "MISC",
            "url": "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-wmx7-x4jp-9jgg",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c1.3.7||\u003e=2.0.0 \u003c2.4.0",
          "affected_versions": "All versions before 1.3.7, all versions starting from 2.0.0 before 2.4.0",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2023-06-27",
          "description": "OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue.",
          "fixed_versions": [
            "1.3.7",
            "2.4.0"
          ],
          "identifier": "CVE-2022-41918",
          "identifiers": [
            "CVE-2022-41918",
            "GHSA-wmx7-x4jp-9jgg"
          ],
          "not_impacted": "All versions starting from 1.3.7 before 2.0.0, all versions starting from 2.4.0",
          "package_slug": "gem/opensearch",
          "pubdate": "2022-11-15",
          "solution": "Upgrade to versions 1.3.7, 2.4.0 or above.",
          "title": "Incorrect Authorization",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-41918",
            "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4",
            "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg"
          ],
          "uuid": "3a0f5156-9ac4-486f-9e25-c630cd21182f"
        },
        {
          "affected_range": "(,1.3.7),[2.0.0,2.4.0)",
          "affected_versions": "All versions before 1.3.7, all versions starting from 2.0.0 before 2.4.0",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "cwe_ids": [
            "CWE-1035",
            "CWE-863",
            "CWE-937"
          ],
          "date": "2023-03-07",
          "description": "OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue.",
          "fixed_versions": [
            "1.3.7",
            "2.4.0"
          ],
          "identifier": "CVE-2022-41918",
          "identifiers": [
            "GHSA-wmx7-x4jp-9jgg",
            "CVE-2022-41918"
          ],
          "not_impacted": "All versions starting from 1.3.7 before 2.0.0, all versions starting from 2.4.0",
          "package_slug": "maven/org.opensearch.plugin/opensearch-security",
          "pubdate": "2023-03-07",
          "solution": "Upgrade to versions 1.3.7, 2.4.0 or above.",
          "title": "Incorrect Authorization",
          "urls": [
            "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-41918",
            "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4",
            "https://github.com/advisories/GHSA-wmx7-x4jp-9jgg"
          ],
          "uuid": "6a7939fe-e9de-4566-a06e-2901db54c8e6"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:amazon:opensearch:*:*:*:*:*:docker:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.3.7",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:amazon:opensearch:*:*:*:*:*:docker:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.4.0",
                "versionStartIncluding": "2.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-41918"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4"
            },
            {
              "name": "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.4
        }
      },
      "lastModifiedDate": "2023-06-27T14:06Z",
      "publishedDate": "2022-11-15T23:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-41918 (GCVE-0-2022-41918)

FKIE_CVE-2022-41918

GHSA-WMX7-X4JP-9JGG

Impact

Patches

Workarounds

For more information

GSD-2022-41918

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour