Exposure of Sensitive Information Through Metadata in OpenSearch

1) Information disclosure

EUVDB-ID: #VU101753

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-23613

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to insertion of sensitive information into metadata. A remote user can send a specially-crafted request to exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

OpenSearch: before 1.3.8

CPE2.3

• cpe:2.3:a:opensearch:opensearch:*:*:*:*:*:*:*:*

External links

http://github.com/opensearch-project/security/security/advisories/GHSA-v3cg-7r9h-r2g6
http://github.com/opensearch-project/OpenSearch/releases/tag/2.5.0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.