CVE-2022-35980

{"containers": {"cna": {"affected": [{"product": "security", "vendor": "opensearch-project", "versions": [{"status": "affected", "version": ">= 2.0.0.0, <= 2.1.0.0"}]}], "descriptions": [{"lang": "en", "value": "OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access control features document level security (DLS), field level security (FLS), and/or field masking will not be filtered when the query's search pattern matches an aliased index. OpenSearch Dashboards creates an alias to `.kibana` by default, so filters with the index pattern of `*` to restrict access to documents or fields will not be applied. This issue allows requests to access sensitive information when customer have acted to restrict access that specific information. OpenSearch 2.2.0, which is compatible with OpenSearch Security 2.2.0.0, contains the fix for this issue. There is no recommended work around."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-612", "description": "CWE-612: Improper Authorization of Index Containing Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-08-12T17:40:09.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-f4qr-f4xx-hjxw"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/opensearch-project/security/pull/1999"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/opensearch-project/security/commit/7eaaafec2939d7db23a02ffca9cc68e0343de246"}], "source": {"advisory": "GHSA-f4qr-f4xx-hjxw", "discovery": "UNKNOWN"}, "title": "OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-35980", "STATE": "PUBLIC", "TITLE": "OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "security", "version": {"version_data": [{"version_value": ">= 2.0.0.0, <= 2.1.0.0"}]}}]}, "vendor_name": "opensearch-project"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access control features document level security (DLS), field level security (FLS), and/or field masking will not be filtered when the query's search pattern matches an aliased index. OpenSearch Dashboards creates an alias to `.kibana` by default, so filters with the index pattern of `*` to restrict access to documents or fields will not be applied. This issue allows requests to access sensitive information when customer have acted to restrict access that specific information. OpenSearch 2.2.0, which is compatible with OpenSearch Security 2.2.0.0, contains the fix for this issue. There is no recommended work around."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-612: Improper Authorization of Index Containing Sensitive Information"}]}]}, "references": {"reference_data": [{"name": "https://github.com/opensearch-project/security/security/advisories/GHSA-f4qr-f4xx-hjxw", "refsource": "CONFIRM", "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-f4qr-f4xx-hjxw"}, {"name": "https://github.com/opensearch-project/security/pull/1999", "refsource": "MISC", "url": "https://github.com/opensearch-project/security/pull/1999"}, {"name": "https://github.com/opensearch-project/security/commit/7eaaafec2939d7db23a02ffca9cc68e0343de246", "refsource": "MISC", "url": "https://github.com/opensearch-project/security/commit/7eaaafec2939d7db23a02ffca9cc68e0343de246"}]}, "source": {"advisory": "GHSA-f4qr-f4xx-hjxw", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:51:59.809Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-f4qr-f4xx-hjxw"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/opensearch-project/security/pull/1999"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/opensearch-project/security/commit/7eaaafec2939d7db23a02ffca9cc68e0343de246"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T15:52:19.692125Z", "id": "CVE-2022-35980", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T17:51:02.584Z"}}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-35980", "datePublished": "2022-08-12T17:40:09.000Z", "dateReserved": "2022-07-15T00:00:00.000Z", "dateUpdated": "2025-04-23T17:51:02.584Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/opensearch-project/security/security/advisories/GHSA-f4qr-f4xx-hjxw", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/opensearch-project/security/pull/1999", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/opensearch-project/security/commit/7eaaafec2939d7db23a02ffca9cc68e0343de246", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:51:59.809Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-35980", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-23T15:52:19.692125Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T15:52:21.927Z"}}], "cna": {"title": "OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information", "source": {"advisory": "GHSA-f4qr-f4xx-hjxw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "opensearch-project", "product": "security", "versions": [{"status": "affected", "version": ">= 2.0.0.0, <= 2.1.0.0"}]}], "references": [{"url": "https://github.com/opensearch-project/security/security/advisories/GHSA-f4qr-f4xx-hjxw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/opensearch-project/security/pull/1999", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/opensearch-project/security/commit/7eaaafec2939d7db23a02ffca9cc68e0343de246", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access control features document level security (DLS), field level security (FLS), and/or field masking will not be filtered when the query's search pattern matches an aliased index. OpenSearch Dashboards creates an alias to `.kibana` by default, so filters with the index pattern of `*` to restrict access to documents or fields will not be applied. This issue allows requests to access sensitive information when customer have acted to restrict access that specific information. OpenSearch 2.2.0, which is compatible with OpenSearch Security 2.2.0.0, contains the fix for this issue. There is no recommended work around."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-612", "description": "CWE-612: Improper Authorization of Index Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-08-12T17:40:09.000Z"}, "x_legacyV4Record": {"impact": {"cvss": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, "source": {"advisory": "GHSA-f4qr-f4xx-hjxw", "discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": ">= 2.0.0.0, <= 2.1.0.0"}]}, "product_name": "security"}]}, "vendor_name": "opensearch-project"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/opensearch-project/security/security/advisories/GHSA-f4qr-f4xx-hjxw", "name": "https://github.com/opensearch-project/security/security/advisories/GHSA-f4qr-f4xx-hjxw", "refsource": "CONFIRM"}, {"url": "https://github.com/opensearch-project/security/pull/1999", "name": "https://github.com/opensearch-project/security/pull/1999", "refsource": "MISC"}, {"url": "https://github.com/opensearch-project/security/commit/7eaaafec2939d7db23a02ffca9cc68e0343de246", "name": "https://github.com/opensearch-project/security/commit/7eaaafec2939d7db23a02ffca9cc68e0343de246", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access control features document level security (DLS), field level security (FLS), and/or field masking will not be filtered when the query's search pattern matches an aliased index. OpenSearch Dashboards creates an alias to `.kibana` by default, so filters with the index pattern of `*` to restrict access to documents or fields will not be applied. This issue allows requests to access sensitive information when customer have acted to restrict access that specific information. OpenSearch 2.2.0, which is compatible with OpenSearch Security 2.2.0.0, contains the fix for this issue. There is no recommended work around."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-612: Improper Authorization of Index Containing Sensitive Information"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-35980", "STATE": "PUBLIC", "TITLE": "OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information", "ASSIGNER": "security-advisories@github.com"}}}}, "cveMetadata": {"cveId": "CVE-2022-35980", "state": "PUBLISHED", "dateUpdated": "2025-04-23T17:51:02.584Z", "dateReserved": "2022-07-15T00:00:00.000Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-08-12T17:40:09.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "security", "vendor": "opensearch-project", "versions": [{"status": "affected", "version": ">= 2.0.0.0, <= 2.1.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:amazon:opensearch:2.0.0:*:*:*:*:docker:*:*", "matchCriteriaId": "C945CD2E-F116-4E29-A8B0-1093165EB9E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:opensearch:2.1.0:*:*:*:*:docker:*:*", "matchCriteriaId": "EF025C8F-AFEB-47E4-A540-95949DBEA74B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access control features document level security (DLS), field level security (FLS), and/or field masking will not be filtered when the query's search pattern matches an aliased index. OpenSearch Dashboards creates an alias to `.kibana` by default, so filters with the index pattern of `*` to restrict access to documents or fields will not be applied. This issue allows requests to access sensitive information when customer have acted to restrict access that specific information. OpenSearch 2.2.0, which is compatible with OpenSearch Security 2.2.0.0, contains the fix for this issue. There is no recommended work around."}, {"lang": "es", "value": "OpenSearch Security es un plugin para OpenSearch que ofrece cifrado, autenticaci\u00f3n y autorizaci\u00f3n. Las versiones 2.0.0.0 y 2.1.0.0 del plugin de seguridad est\u00e1n afectadas por una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n. Las peticiones a un cl\u00faster de OpenSearch configurado con las funciones de control de acceso avanzado de seguridad a nivel de documento (DLS), seguridad a nivel de campo (FLS) y/o enmascaramiento de campos no son filtradas cuando el patr\u00f3n de b\u00fasqueda de la consulta coincida con un \u00edndice de alias. OpenSearch Dashboards crea un alias a \".kibana\" por defecto, por lo que los filtros con el patr\u00f3n de \u00edndice de \"*\" para restringir el acceso a documentos o campos no ser\u00e1n aplicados. Este problema permite que las peticiones accedan a informaci\u00f3n confidencial cuando el cliente ha actuado para restringir el acceso a esa informaci\u00f3n espec\u00edfica. OpenSearch versi\u00f3n 2.2.0, que es compatible con OpenSearch Security versi\u00f3n 2.2.0.0, contiene la correcci\u00f3n de este problema. No se presenta ninguna mitigaci\u00f3n recomendada."}], "id": "CVE-2022-35980", "lastModified": "2026-06-17T04:52:38.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-35980", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-23T15:52:19.692125Z", "version": "2.0.3"}}]}, "published": "2022-08-12T18:15:13.510", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/opensearch-project/security/commit/7eaaafec2939d7db23a02ffca9cc68e0343de246"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/opensearch-project/security/pull/1999"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-f4qr-f4xx-hjxw"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/opensearch-project/security/commit/7eaaafec2939d7db23a02ffca9cc68e0343de246"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/opensearch-project/security/pull/1999"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-f4qr-f4xx-hjxw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-612"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}