Medium severity · published Jul 9, 2024
CVE-2024-39901
OpenSearch Observability is collection of plugins and applications that visualize data-driven events
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OB
Observability · Opensearch
before 2.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39901
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39901
Patch
https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e
Third Party Advisory
https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33
Product
https://opensearch.org/versions/opensearch-2-14-0.html
More from Observability
5.4
CVE-2024-39900
OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards