CVE-2023-45807

Summary

CVE-2023-45807 is a vulnerability affecting OpenSearch, an open-source fork of Elasticsearch and Kibana. The issue lies in the implementation of tenant permissions in OpenSearch Dashboards, which enables authenticated users with read-only access to a tenant to execute create, edit, and delete operations on index metadata of dashboards and visualizations within that tenant. Although it does not impact index data, these actions can potentially render the affected metadata unavailable. Users with read-access to data are not granted any additional privileges. Administers can mitigate this issue by disabling the tenants functionality for their clusters. Versions 1.3.14 and 2.11.0 have been released with the necessary fixes for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.