PT-2023-19075 · Unknown+1 · Opensearch+1

Cehenkle · Published 2023-01-24 · Updated 2025-04-03 · CVE-2023-23613

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSearch versions 1.0.0 through 1.3.7 OpenSearch versions 2.0.0 through 2.4.1

Description There is an issue in the implementation of field-level security (FLS) and field masking where rules written to explicitly exclude fields are not correctly applied for certain queries that rely on their auto-generated .keyword fields. This issue is only present for authenticated users with read access to the indexes containing the restricted fields, which may expose data that would otherwise not be accessible to the user.

Recommendations For OpenSearch versions 1.0.0 through 1.3.7, upgrade to OpenSearch 1.3.8. For OpenSearch versions 2.0.0 through 2.4.1, upgrade to OpenSearch 2.5.0. As a temporary workaround for users unable to upgrade, consider writing explicit exclusion rules to grant explicit access instead, as policies authored in this way are not subject to this issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-04294

CVE-2023-23613

GHSA-V3CG-7R9H-R2G6

Affected Products

Opensearch

Red Os

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23613.json · Exploit
• https://cve.org/CVERecord?id=CVE-2023-23613 · Security Note
• https://bdu.fstec.ru/vul/2025-04294 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-23613 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23613 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23613 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v3cg-7r9h-r2g6 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-23613 · Vendor Advisory
• https://github.com/opensearch-project/OpenSearch/releases/tag/2.5.0 · Note
• https://github.com/opensearch-project/security · Note
• https://github.com/opensearch-project/security/security/advisories/GHSA-v3cg-7r9h-r2g6 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-opensearch-cve-2023-23612-cve-2023-23613 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23613 · Note