CVE-2024-39900

Katalog CVE

CVSS 5.4 · Medium EPSS 0,31%

Kerentanan Authorization Bypass Through User-Controlled Key pada opensearch observability. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.

Rincian

Terbit di NVD

9 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/opensearch-project/reporting/commit/2403014c57ee63268e83d919db3334b676a8c992 patch
• https://github.com/opensearch-project/reporting/security/advisories/GHSA-xmvg-335g-x44q advisory pihak ketiga
• https://opensearch.org/versions/opensearch-2-14-0.html product