CVE-2022-41917

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to process data for text analysis. An issue in the implementation of this feature allows certain specially crafted queries to return a response containing the first line of text from arbitrary files. The list of potentially impacted files is limited to text files with read permissions allowed in the Java Security Manager policy configuration. OpenSearch version 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200CWE-755

Affected software

No affected versions have been published.

Timeline

Published
Nov 16, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-419186.3OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained acCVE-2022-419198.8Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `PCVE-2022-41928.8Use after free in Live Caption in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific CVE-2022-419208.8Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutiCVE-2022-419214.3Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which cCVE-2022-419229.8`yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary userCVE-2022-419239.8Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. CVE-2022-419249.6A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, whicCVE-2022-419258.8A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access TailsCVE-2022-419265.5Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protecteCVE-2022-419277.4XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confCVE-2022-419288.8XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xm
CVE-2022-41917: Medium severity, CVSS 4.3 | Vulnix