#VU101753 Information disclosure in OpenSearch - CVE-2023-23613

Vulnerability identifier: #VU101753

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-23613

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
OpenSearch
Other software / Other software solutions

Vendor: OpenSearch

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to insertion of sensitive information into metadata. A remote user can send a specially-crafted request to exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

OpenSearch: before 1.3.8

---

External links
https://github.com/opensearch-project/security/security/advisories/GHSA-v3cg-7r9h-r2g6
https://github.com/opensearch-project/OpenSearch/releases/tag/2.5.0

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.