CVE-2023-25806mediumCWE-208

CVE-2023-25806: falha de média gravidade em opensearch-project security

Time discrepancy in authentication responses in OpenSearch

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar security+ Monitorar org.opensearch.plugin:opensearch-security

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. Patches were released in versions 1.3.9 and 2.6.0, there are no workarounds.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
opensearch-project · security
CVEs relacionadas — opensearch-project security

No mesmo produto, das mais perigosas para as menos.

CVE-2022-35980HIGHOpenSearch vulnerable to Improper Authorization of Index Containing Sensitive InformationEPSS 1.2%CVE-2023-23613MEDIUMField-level security issue with .keyword fields in OpenSearchEPSS 0.9%CVE-2023-23612MEDIUMIssue with whitespace in JWT roles in OpenSearchEPSS 0.8%CVE-2023-45807MEDIUMOpenSearch Issue with tenant read-only permissionsEPSS 0.5%CVE-2022-41918MEDIUMIssue with fine-grained access control of indices backing data streamsEPSS 0.5%CVE-2023-31141MEDIUMOpenSearch issue with fine-grained access control during extremely rare race conditionsEPSS 0.5%