VULNERABILITY INTELLIGENCE

CVE-2024-39900

CVSS score5.4 MEDIUM

EPSS probability0.30%

CISA KEVNot currently listed

Published2024-07-09

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Description

OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.

Weakness classification

security-advisories@github.com: CWE-639
nvd@nist.gov: CWE-639

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Third Party Advisory
security-advisories@github.com — Product
af854a3a-2127-422b-91ae-364da2661108 — Patch
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Product