CVE-2023-31141

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-31141
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-31141.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-31141
Aliases
Downstream
Published
2023-05-08T20:33:58.601Z
Modified
2026-03-14T12:06:54.867528Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
OpenSearch issue with fine-grained access control during extremely rare race conditions
Details

OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. OpenSearch 1.3.10 and 2.7.0 contain a fix for this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31141.json"
}
References

Affected packages

Git / github.com/opensearch-project/security

Affected ranges

Type
GIT
Repo
https://github.com/opensearch-project/security
Events
Introduced
cd6df074a44b5ebc1c22940e6d2d149f162f475c
Fixed
87c8e468f4c47bea0a140b52e39197aef4ff45ba
Database specific 
{
    "versions": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.3.10"
        }
    ]
}
Type
GIT
Repo
https://github.com/opensearch-project/security
Events
Introduced
5e6457703a6609c556f357aafdb116f4a2f30c05
Fixed
54aee2d1f276181c15f4b458dbe926f33a9d0d83
Database specific 
{
    "versions": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.7.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-31141.json"