CVE-2022-41917

MEDIUM

OpenSearch 1.0.0-1.3.6 - Information Disclosure via Text Analyzer File Handling

Title source: llm
STIX 2.1

Description

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to process data for text analysis. An issue in the implementation of this feature allows certain specially crafted queries to return a response containing the first line of text from arbitrary files. The list of potentially impacted files is limited to text files with read permissions allowed in the Java Security Manager policy configuration. OpenSearch version 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.

References (2)

Core 2

Scores

CVSS v3 4.3
EPSS 0.0052
EPSS Percentile 39.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-755 CWE-200
Status published
Products (1)
amazon/opensearch 1.0.0 - 1.3.7
Published Nov 16, 2022
Tracked Since Feb 18, 2026