PT-2023-7035 · Unknown+1 · Opensearch Dashboards+2

Cehenkle · Published 2023-10-16 · Updated 2023-11-21 · CVE-2023-45807

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenSearch versions prior to 1.3.14 OpenSearch versions prior to 2.11.0

Description There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have.

Recommendations For versions prior to 1.3.14, update to version 1.3.14 or later to resolve the issue. For versions prior to 2.11.0, update to version 2.11.0 or later to resolve the issue. As a temporary workaround, consider disabling the tenants functionality for the cluster until a patch is available.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

BDU:2023-08057

CVE-2023-45807

GHSA-72Q2-GWWF-6HRV

Affected Products

Opensearch

Opensearch Dashboards

Red Os

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45807.json · Exploit
• https://github.com/opensearch-project/security/security/advisories/GHSA-72q2-gwwf-6hrv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45807 · Security Note
• https://osv.dev/vulnerability/GHSA-72q2-gwwf-6hrv · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-45807 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08057 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-45807 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-45807 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45807 · Vendor Advisory
• https://github.com/opensearch-project/security · Note
• https://redos.red-soft.ru/support/secure · Note
• https://t.me/cibsecurity/72377 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45807 · Note
• https://twitter.com/VulmonFeeds/status/1714079463447605725 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-opensearch-cve-2023-45807 · Note