CVE-2022-41917— Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-41917
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch
Source: NVD (National Vulnerability Database)
Vulnerability Description
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to process data for text analysis. An issue in the implementation of this feature allows certain specially crafted queries to return a response containing the first line of text from arbitrary files. The list of potentially impacted files is limited to text files with read permissions allowed in the Java Security Manager policy configuration. OpenSearch version 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
OpenSearch Project 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenSearch Project是OpenSearch Project开源的一个社区驱动的、Apache 2.0许可的开放源代码搜索和分析套件。使其易于获取、搜索、可视化和分析数据。 OpenSearch Project 1.3.7之前版本和2.4.0之前的2.x版本存在信息泄露漏洞，该漏洞源于允许某些特制查询返回包含任意文件第一行文本的响应。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| opensearch-project | OpenSearch | < 1.3.7 | - |
II. Public POCs for CVE-2022-41917
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-41917
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: opensearch-project
- CVE-2025-62371
OpenSearch Data Prepper plugins trusts all SSL certificates - CVE-2024-55886
OpenTelemetry Logs source may lack authentication with some - CVE-2024-43794
OpenSearch Dashboards Security Plugin improper validation of - CVE-2024-39900
OpenSearch Dashboards Reports does not properly restrict acc - CVE-2024-39901
OpenSearch Observability does not properly restrict access t
Same weakness: CWE-200
- CVE-2026-42333
quarkus-openapi-generator has overly broad path-parameter ma - CVE-2026-8198
Activity Logs, User Activity Tracking, Multisite Activity Lo - CVE-2026-42456
AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (ID - CVE-2026-41520
Cillium exposes sensitive information included in the cilium - CVE-2026-25199
Apache CloudStack: Proxmox Extension Allows Unauthorized Cro
V. Comments for CVE-2022-41917
No comments yet