Medium severity · published Jul 9, 2024
CVE-2024-39900
OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OB
Observability · Opensearch
before 2.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39900
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39900
Patch
https://github.com/opensearch-project/reporting/commit/2403014c57ee63268e83d919db3334b676a8c992
Third Party Advisory
https://github.com/opensearch-project/reporting/security/advisories/GHSA-xmvg-335g-x44q
Product
https://opensearch.org/versions/opensearch-2-14-0.html
More from Observability
5.4
CVE-2024-39901
OpenSearch Observability is collection of plugins and applications that visualize data-driven events