Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
CVE-2023-31141: OpenSearch versions before 1.3.10 and 2.7.0 allow unauthorized access under rare conditions
CVE-2023-31141 · published 3 years ago
Summary
Prior to versions 1.3.10 and 2.7.0, OpenSearch may incorrectly apply access controls, potentially allowing unauthorized users to see sensitive data. This only happens in extremely rare situations, but it's crucial to update to the latest versions to prevent any potential issues. Upgrade to OpenSearch 1.3.10 or 2.7.0 to ensure correct access authorization.
What to do
- Update opensearch org.opensearch.plugin:opensearch-security to version 1.3.10.0.
- Update opensearch org.opensearch.plugin:opensearch-security to version 2.7.0.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | opensearch | org.opensearch.plugin:opensearch-security |
>= 1.0.0, < 1.3.10.0 >= 2.0.0, < 2.7.0.0 Fix: upgrade to 1.3.10.0
|
| – | amazon | opensearch |
< 1.3.10 >= 2.0.0, < 2.7.0 cpe:2.3:a:amazon:opensearch:*:*:*:*:*:docker:*:* |
| – | amazon | opensearch_security |
< 1.3.10 >= 2.0.0, < 2.7.0 cpe:2.3:a:amazon:opensearch_security:*:*:*:*:*:*:*:* |
Original advisory text
OpenSearch issue with fine-grained access control during extremely rare race conditions
OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. OpenSearch 1.3.10 and 2.7.0 contain a fix for this issue.
References
- https://github.com/advisories/GHSA-g8xc-6mf7-h28h
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31141... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-31141 Vendor Advisory
- https://github.com/opensearch-project/security/security/advisories/GHSA-g8xc-6mf... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-863Incorrect Authorization
Timeline
Published8 May 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta