CVE-2022-41918

MEDIUM

OpenSearch < 1.3.7 - Incorrect Authorization in Fine-Grained Access Control Rules

Title source: llm
STIX 2.1

Description

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue.

References (2)

Core 2

Scores

CVSS v3 6.3
EPSS 0.0020
EPSS Percentile 41.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-863 CWE-612
Status published
Products (2)
amazon/opensearch < 1.3.7
org.opensearch.plugin/opensearch-security 0 - 1.3.7Maven
Published Nov 15, 2022
Tracked Since Feb 18, 2026