CVE-2023-45807

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have. This issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-281

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-458085.4iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo CVE-2023-458092.7Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin c CVE-2023-45814.3Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any w CVE-2023-458107.5OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are CVE-2023-458117.8Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Succ CVE-2023-458127.5The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation CVE-2023-458137.5Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the CVE-2023-458145.3Bunkum is an open-source protocol-agnostic request server for custom game servers. First, a little bit of background. So, in the beginning, CVE-2023-458155.4ArchiveBox is an open source self-hosted web archiving system. Any users who are using the `wget` extractor and view the content it outputs.CVE-2023-458163.3Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the CVE-2023-458186.1TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and r CVE-2023-458196.1TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API.