org.opensearch.plugin:opensearch-security
Maven7 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting org.opensearch.plugin:opensearch-securitypage 1 of 1
- CVE-2022-35980HIGHCVSS 7.5EG 7.5fixed in 2.2.0.02022-08-12
vulnerable: 2.1.0.0
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch…
- CVE-2022-41918MEDIUMCVSS 6.3EG 6.3fixed in 1.3.7 or 2.4.0, by version range2022-11-15
vulnerable: 2.1.0.0, 2.2.0.0, 2.2.1.0, 2.3.0.0
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are…
- CVE-2023-23612MEDIUMCVSS 4.7EG 4.7fixed in 1.3.8 or 2.5.0, by version range2023-01-26
vulnerable: 2.1.0.0 ... 2.4.1.0 (6 versions)
OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how tho…
- CVE-2023-23613MEDIUMCVSS 5.7EG 5.7fixed in 1.3.8 or 2.5.0, by version range2023-01-26
vulnerable: 2.1.0.0 ... 2.4.1.0 (6 versions)
OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security (FLS) and field masking where rules written to explicitly exclude fields are not corre…
- CVE-2023-25806MEDIUMCVSS 5.3EG 5.3fixed in 1.3.9 or 2.6.0, by version range2023-03-02
vulnerable: 2.1.0.0 ... 2.5.0.0 (7 versions)
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it…
- CVE-2023-31141MEDIUMCVSS 4.8EG 4.8fixed in 1.3.10.0 or 2.7.0.0, by version range2023-05-08
vulnerable: 2.1.0.0 ... 2.6.0.0 (8 versions)
OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, fi…
- CVE-2023-45807MEDIUMCVSS 5.4EG 5.4fixed in 2.11.0.0 or 1.3.14.0, by version range2023-10-16
vulnerable: 2.1.0.0 ... 2.9.0.0 (12 versions)
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users w…
Check whether org.opensearch.plugin:opensearch-security is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.opensearch.plugin:opensearch-security CVEs against the assets you own.
Book a Demo →