CVE-2023-25806

Katalog CVE

CVSS 5.3 · Medium EPSS 0,33%

Kerentanan Observable Timing Discrepancy pada amazon opensearch, amazon opensearch security. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. Patches were released in versions 1.3.9 and 2.6.0, there are no workarounds.

Rincian

Terbit di NVD

2 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-208: Observable Timing Discrepancy
CWE-203: Observable Discrepancy

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/opensearch-project/security/security/advisories/GHSA-c6wg-cm5x-rqvj advisory vendor