PT-2022-26147 · Unknown · Opensearch

Cehenkle · Published 2022-11-15 · Updated 2023-07-10 · CVE-2022-41917

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSearch versions prior to 1.3.7 OpenSearch versions prior to 2.4.0

Description An issue in OpenSearch allows certain specially crafted queries to return a response containing the first line of text from arbitrary files. The list of potentially impacted files is limited to text files with read permissions allowed in the Java Security Manager policy configuration.

Recommendations For OpenSearch versions prior to 1.3.7, upgrade to version 1.3.7 or later. For OpenSearch versions prior to 2.4.0, upgrade to version 2.4.0 or later.

Exploit

Fix

Improper Handling of Exceptional Conditions

Information Disclosure

Weakness Enumeration

CWE-755

CWE-200

Related Identifiers

CVE-2022-41917

GHSA-W3RX-M34V-WRQX

Affected Products

Opensearch

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41917.json · Exploit
• https://github.com/opensearch-project/OpenSearch/commit/6d20423f5920745463b1abc5f1daf6a786c41aa0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41917 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41917 · Vendor Advisory
• https://github.com/opensearch-project/OpenSearch/security/advisories/GHSA-w3rx-m34v-wrqx · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41917 · Note
• https://t.me/cvenotify/37836 · Telegram Post
• https://t.me/cibsecurity/52975 · Telegram Post