← Vulnerability feed

Vulnerability record · CVE-2022-35980 · published 12 August 2022

CVE-2022-35980: Amazon opensearch vulnerability

Amazon · Opensearch

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access control features document level security (DLS), field level security (FLS), and/or field masking will not be filtered when the query's search pattern matches an aliased index. OpenSearch Dashboards creates an alias to `.kibana` by default, so filters with the index pattern of `*` to restrict access to documents or fields will not be applied. This issue allows requests to access sensitive information when customer have acted to restrict access that specific information. OpenSearch 2.2.0, which is compatible with OpenSearch Security 2.2.0.0, contains the fix for this issue. There is no recommended work around.

7.5 CVSS 3.1 High EPSS 1.2% · top 33.9% CWE-612 · CWE-612
7.5CVSS 3.1 base score
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access control features document level security (DLS), field level security (FLS), and/or field masking will not be filtered when the query's search pattern matches an aliased index. OpenSearch Dashboards creates an alias to `.kibana` by default, so filters with the index pattern of `*` to restrict access to documents or fields will not be applied. This issue allows requests to access sensitive information when customer have acted to restrict access that specific information. OpenSearch 2.2.0, which is compatible with OpenSearch Security 2.2.0.0, contains the fix for this issue. There is no recommended work around.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/opensearch-project/security/commit/7eaaafec2939d7db23a02ffca9cc68e0343de246 PatchThird Party Advisory
https://github.com/opensearch-project/security/pull/1999 PatchThird Party Advisory
https://github.com/opensearch-project/security/security/advisories/GHSA-f4qr-f4xx-hjxw Third Party Advisory
https://github.com/opensearch-project/security/commit/7eaaafec2939d7db23a02ffca9cc68e0343de246 PatchThird Party Advisory
https://github.com/opensearch-project/security/pull/1999 PatchThird Party Advisory
https://github.com/opensearch-project/security/security/advisories/GHSA-f4qr-f4xx-hjxw Third Party Advisory

Track CVE-2022-35980 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2023-23612Amazon opensearch improper authentication vulnerabilityOpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (Id…EPSS 0.80%8.8CVE-2022-31115Amazon opensearch deserialization of untrusted data vulnerabilityopensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby `YAML.load` function was used inst…EPSS 1.6%8.3CVE-2025-9624Amazon opensearch vulnerabilityA vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string inputs. This issue affects all Ope…EPSS 0.51%6.5CVE-2023-23613Amazon opensearch information exposure vulnerabilityOpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level secur…EPSS 0.82%6.3CVE-2022-41918Amazon opensearch incorrect authorization vulnerabilityOpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access cont…EPSS 0.47%5.9CVE-2023-31141Amazon opensearch incorrect authorization vulnerabilityOpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue…EPSS 0.46%5.4CVE-2023-45807Amazon opensearch vulnerabilityOpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the…EPSS 0.41%5.3CVE-2023-25806Amazon opensearch observable discrepancy vulnerabilityOpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the au…EPSS 0.33%

Source: NIST National Vulnerability Database (record CVE-2022-35980), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.