Vulnerability-Lookup

CVE-2024-39901 (GCVE-0-2024-39901)

Vulnerability from cvelistv5 – Published: 2024-07-09 21:14 – Updated: 2024-08-02 04:33

Title

OpenSearch Observability does not properly restrict access to private tenant resources

Summary

OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.

Severity ?

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M

References

URL

Tags

	https://github.com/opensearch-project/observabili…	x_refsource_CONFIRM
	https://github.com/opensearch-project/observabili…	x_refsource_MISC
	https://opensearch.org/versions/opensearch-2-14-0.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	opensearch-project	observability	Affected: < 2.14.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39901",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-10T14:06:06.262219Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-10T14:08:16.122Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:33:11.298Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33"
          },
          {
            "name": "https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e"
          },
          {
            "name": "https://opensearch.org/versions/opensearch-2-14-0.html",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://opensearch.org/versions/opensearch-2-14-0.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "observability",
          "vendor": "opensearch-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.14.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-18T15:01:08.334Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33"
        },
        {
          "name": "https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e"
        },
        {
          "name": "https://opensearch.org/versions/opensearch-2-14-0.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://opensearch.org/versions/opensearch-2-14-0.html"
        }
      ],
      "source": {
        "advisory": "GHSA-77vc-rj32-2r33",
        "discovery": "UNKNOWN"
      },
      "title": "OpenSearch Observability does not properly restrict access to private tenant resources"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-39901",
    "datePublished": "2024-07-09T21:14:28.777Z",
    "dateReserved": "2024-07-02T19:37:18.599Z",
    "dateUpdated": "2024-08-02T04:33:11.298Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33\", \"name\": \"https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e\", \"name\": \"https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://opensearch.org/versions/opensearch-2-14-0.html\", \"name\": \"https://opensearch.org/versions/opensearch-2-14-0.html\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:33:11.298Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39901\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-10T14:06:06.262219Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-10T14:08:10.779Z\"}}], \"cna\": {\"title\": \"OpenSearch Observability does not properly restrict access to private tenant resources\", \"source\": {\"advisory\": \"GHSA-77vc-rj32-2r33\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"opensearch-project\", \"product\": \"observability\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.14.0.0\"}]}], \"references\": [{\"url\": \"https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33\", \"name\": \"https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e\", \"name\": \"https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://opensearch.org/versions/opensearch-2-14-0.html\", \"name\": \"https://opensearch.org/versions/opensearch-2-14-0.html\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-07-18T15:01:08.334Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39901\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T04:33:11.298Z\", \"dateReserved\": \"2024-07-02T19:37:18.599Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-07-09T21:14:28.777Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-77VC-RJ32-2R33

Vulnerability from github – Published: 2024-07-10 16:04 – Updated: 2024-11-18 16:26

Summary

OpenSearch Observability does not properly restrict access to private tenant resources

Details

Summary

An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed.

Impact

The lack of proper access control validation for private tenant resources in the OpenSearch observability and reporting plugins can lead to unintended data access. If an authorized user with observability or reporting roles is aware of another user's private tenant resource ID, such as a notebook, they can potentially read, modify, or take ownership of that resource, despite not being the original author, thus impacting the confidentiality and integrity of private tenant resources. The impact is confined to private tenant resources, where authorized users may gain inappropriate visibility into data intended to be private from other users within the same OpenSearch instance, potentially violating the intended separation of access. This issue does not alter the scope of access but highlights a flaw in the existing access control mechanisms.

Impacted versions <= 2.13

Patches

The patches are included in OpenSearch 2.14

Workarounds

None

References

OpenSearch 2.14 is available for download at https://opensearch.org/versions/opensearch-2-14-0.html

The latest version of OpenSearch is available for download at https://opensearch.org/downloads.html

Severity ?

4.2 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

2.3 (Low)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.opensearch.plugin:opensearch-observability"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.14.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-39901"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-10T16:04:08Z",
    "nvd_published_at": "2024-07-09T22:15:03Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nAn issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed.\n\n### Impact\n\nThe lack of proper access control validation for private tenant resources in the OpenSearch observability and reporting plugins can lead to unintended data access. If an authorized user with observability or reporting roles is aware of another user\u0027s private tenant resource ID, such as a notebook, they can potentially read, modify, or take ownership of that resource, despite not being the original author, thus impacting the confidentiality and integrity of private tenant resources. The impact is confined to private tenant resources, where authorized users may gain inappropriate visibility into data intended to be private from other users within the same OpenSearch instance, potentially violating the intended separation of access. This issue does not alter the scope of access but highlights a flaw in the existing access control mechanisms.\n\nImpacted versions \u003c= 2.13\n\n### Patches\n\nThe patches are included in OpenSearch 2.14\n\n### Workarounds\n\nNone\n\n### References\n\nOpenSearch 2.14 is available for download at https://opensearch.org/versions/opensearch-2-14-0.html\n\nThe latest version of OpenSearch is available for download at https://opensearch.org/downloads.html",
  "id": "GHSA-77vc-rj32-2r33",
  "modified": "2024-11-18T16:26:51Z",
  "published": "2024-07-10T16:04:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39901"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/opensearch-project/observability"
    },
    {
      "type": "WEB",
      "url": "https://opensearch.org/versions/opensearch-2-14-0.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenSearch Observability does not properly restrict access to private tenant resources"
}

FKIE_CVE-2024-39901

Vulnerability from fkie_nvd - Published: 2024-07-09 22:15 - Updated: 2024-11-21 09:28

Severity ?

4.2 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e	Patch
security-advisories@github.com	https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33	Third Party Advisory
security-advisories@github.com	https://opensearch.org/versions/opensearch-2-14-0.html	Product
af854a3a-2127-422b-91ae-364da2661108	https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://opensearch.org/versions/opensearch-2-14-0.html	Product

Impacted products

	Vendor	Product	Version
	opensearch	observability	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensearch:observability:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0A26A7A-D86D-48F6-A48F-83FA71FEFE7A",
              "versionEndExcluding": "2.14",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14."
    },
    {
      "lang": "es",
      "value": "OpenSearch Observability es una colecci\u00f3n de complementos y aplicaciones que visualizan eventos basados en datos. Un problema en los complementos de OpenSearch observability permite el acceso no deseado a recursos privados de inquilinos, como cuadernos. El sistema no verific\u00f3 adecuadamente si el usuario era el autor del recurso al acceder a recursos en un inquilino privado, lo que llev\u00f3 a que se revelaran posibles datos. Los parches est\u00e1n incluidos en OpenSearch 2.14."
    }
  ],
  "id": "CVE-2024-39901",
  "lastModified": "2024-11-21T09:28:31.763",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-07-09T22:15:03.450",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://opensearch.org/versions/opensearch-2-14-0.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://opensearch.org/versions/opensearch-2-14-0.html"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-39901 (GCVE-0-2024-39901)

GHSA-77VC-RJ32-2R33

Summary

Impact

Patches

Workarounds

References

FKIE_CVE-2024-39901

Tags

Sightings

Nomenclature