# org.opensearch.plugin:opensearch-security (Maven) vulnerabilities

7 known vulnerabilities (1 high, 6 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.opensearch.plugin/opensearch-security

## Advisories (7)

### [CVE-2023-45807](https://cve.now/CVE-2023-45807): OpenSearch Issue with tenant read-only permissions

- Severity: Medium 5.4
- Published: Oct 16, 2023
- Affected: from 2.0.0.0, fixed in 2.11.0.0; fixed in 1.3.14.0.

### [CVE-2023-31141](https://cve.now/CVE-2023-31141): OpenSearch issue with fine-grained access control during extremely rare race conditions

- Severity: Medium 4.8
- Published: May 8, 2023
- Affected: from 1.0.0, fixed in 1.3.10.0; from 2.0.0, fixed in 2.7.0.0.

### [CVE-2023-25806](https://cve.now/CVE-2023-25806): Time discrepancy in authentication responses in OpenSearch

- Severity: Medium 5.3
- Published: Mar 2, 2023
- Affected: fixed in 1.3.9; from 2.0.0, fixed in 2.6.0.

### [CVE-2023-23612](https://cve.now/CVE-2023-23612): Issue with whitespace in JWT roles in OpenSearch

- Severity: Medium 4.7
- Published: Jan 24, 2023
- Affected: fixed in 1.3.8; from 2.0.0, fixed in 2.5.0.

### [CVE-2023-23613](https://cve.now/CVE-2023-23613): Field-level security issue with .keyword fields in OpenSearch

- Severity: Medium 5.7
- Published: Jan 24, 2023
- Affected: fixed in 1.3.8; from 2.0.0, fixed in 2.5.0.

### [CVE-2022-41918](https://cve.now/CVE-2022-41918): Issue with fine-grained access control of indices backing data streams

- Severity: Medium 6.3
- Published: Nov 15, 2022
- Affected: fixed in 1.3.7; from 2.0.0, fixed in 2.4.0.

### [CVE-2022-35980](https://cve.now/CVE-2022-35980): OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information

- Severity: High 7.5
- Published: Aug 12, 2022
- Affected: from 2.0.0.0, fixed in 2.2.0.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.opensearch.plugin:opensearch-security
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.