CVE-2024-39901

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Jul 9, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-399024.3Tuleap is an open source suite to improve management of software developments and collaboration. Prior to Tuleap Community Edition 15.10.99.CVE-2024-399037.5Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified iCVE-2024-399048.8VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbiCVE-2024-399055.3Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permisCVE-2024-399068.3A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affectCVE-2024-399079.81Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filCVE-2024-399084.3REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific charaCVE-2024-399096.5KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystCVE-2024-39915.4The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress iCVE-2024-399104.8decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG edCVE-2024-399119.81Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issuCVE-2024-399125.3web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mecha