Cyber Resilience

CVE-2024-39901

Medium

Published: 09 July 2024

Published
09 July 2024
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0024 47.1th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-39901 is a medium-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Opensearch Observability. Its CVSS base score is 4.2 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked at the 47.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource…

more

author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.

CWE(s)
CWE-639

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
attack.mitre.org →
T1654 Log Enumeration Discovery
Adversaries may enumerate system and service logs to find useful data.
attack.mitre.org →
Why these techniques?

Improper authorization in OpenSearch observability plugins enables low-privileged users (with observability/reporting roles) to bypass tenancy controls, read/modify private resources like notebooks containing data-driven events/logs (T1213.006 Databases, T1654 Log Enumeration), and manipulate stored data (T1565.001).

Affected Assets

opensearch
observability
≤ 2.14

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-24 Access Control Decisions
addresses: CWE-639

Per-request decision making makes it harder to bypass authorization using user-controlled keys without proper validation in the decision process.

AC-3 Access Enforcement
addresses: CWE-639

Consistent enforcement of approved authorizations makes bypassing via user-controlled keys ineffective.

References