security vulnerabilities

2 known vulnerabilities in security from Opensearch-project. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  security: Improper Authentication

  CVE-2023-23612Jan 26, 2023Opensearch-project

  OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are process

• 7.5 High severity

  security: Improper Authorization of Index Containing Sensitive Information

  CVE-2022-35980Aug 12, 2022Opensearch-projectEPSS 1.23%

  OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured w