CVE-2024-39900CWE-639

OpenSearch Dashboards Reports does not properly restrict access to private tenant resources

Medium · published July 9, 2024

CVSS v3.1
5.4
EPSS
0%
Percentile
22.0
In the wild
Unconfirmed
What it is

OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2024-07-09T21:17Z
EPSS history
Timeline
  • 09 JUL 21:17Z
    OpenSearch Dashboards Reports does not properly restrict access to private tenant resources
    cvelistv5