Information Exposure Affecting org.opensearch.plugin:opensearch-security package, versions [,2.19.3.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGOPENSEARCHPLUGIN-11509796
- published8 Aug 2025
- disclosed1 Aug 2025
- creditUnknown
Introduced: 1 Aug 2025
New CVE NOT AVAILABLE CWE-200 (opens in a new tab)How to fix?
Upgrade org.opensearch.plugin:opensearch-security to version 2.19.3.0 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure in the application of Field Level Security (FLS) rules to fields that are members of an object within a source document. An attacker can gain unauthorized access to sensitive data by reconstructing the contents of protected fields using range queries, even when exclusion rules are applied to the parent object.
Workaround
This vulnerability can be mitigated by adding additional exclusion rules for the members of the object (for example, using ~object.* in addition to ~object).