PT-2025-32597 · Linux Foundation+1 · Opensearch+1

Published 2025-08-01 · Updated 2025-08-01

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSearch versions prior to 3.0.0 OpenSearch versions 2.19.2 and earlier

Description A flaw exists in OpenSearch where Field Level Security (FLS) rules are not correctly applied to fields nested within JSON objects. Specifically, when an FLS exclusion rule is applied to an object, the object itself is removed from search results, but its member attributes remain accessible through range queries, potentially allowing reconstruction of the original field contents.

Recommendations Update to OpenSearch version 3.0.0 or later. Update to OpenSearch version 2.19.3 or later. If using FLS exclusion rules for object valued attributes, add additional exclusion rules for the members of the object.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-2RJV-CV85-XHGM

Affected Products

Opensearch

Org.Opensearch.Plugin:Opensearch-Security

References · 3

• https://osv.dev/vulnerability/GHSA-2rjv-cv85-xhgm · Vendor Advisory
• https://github.com/opensearch-project/security · Note
• https://github.com/opensearch-project/security/security/advisories/GHSA-2rjv-cv85-xhgm · Note