PT-2023-19306 · Opensearch+2 · Anomaly Detection Plugin+2
Cehenkle
·
Publicado
2023-02-03
·
Atualizado
2025-04-03
·
CVE-2023-23933
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
OpenSearch versions prior to 1.3.8
OpenSearch versions prior to 2.6.0
Description
There is an issue with the application of document and field level restrictions in the Anomaly Detection plugin, where users with the Anomaly Detector role can read aggregated numerical data of fields that are otherwise restricted to them. This issue only affects authenticated users who were previously granted read access to the indexes containing the restricted fields.
Recommendations
For versions prior to 1.3.8, update to version 1.3.8 or later to resolve the issue.
For versions prior to 2.6.0, update to version 2.6.0 or later to resolve the issue.
Exploit
Correção
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Anomaly Detection Plugin
Opensearch
Red Os