{"cve":"CVE-2023-23613","nvd":{"published":"2023-01-26T21:18:14.900","modified":"2026-06-17T05:37:35.063","status":"Modified","description":"OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security (FLS) and field masking where rules written to explicitly exclude fields are not correctly applied for certain queries that rely on their auto-generated .keyword fields. This issue is only present for authenticated users with read access to the indexes containing the restricted fields. This may expose data which may otherwise not be accessible to the user. OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1 are affected. Users are advised to upgrade to OpenSearch 1.3.8 or 2.5.0. Users unable to upgrade may write explicit exclusion rules as a workaround. Policies authored in this way are not subject to this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-200"],"references":["https://github.com/opensearch-project/OpenSearch/releases/tag/2.5.0","https://github.com/opensearch-project/security/security/advisories/GHSA-v3cg-7r9h-r2g6","https://github.com/opensearch-project/OpenSearch/releases/tag/2.5.0","https://github.com/opensearch-project/security/security/advisories/GHSA-v3cg-7r9h-r2g6"],"products":["amazon:opensearch"],"source":"nvd","synced_at":"2026-10-19T21:37:34.931465858+00:00"},"epss":{"cve":"CVE-2023-23613","score":0.00821,"percentile":0.57298,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-v3cg-7r9h-r2g6","url":"https://osv.dev/vulnerability/GHSA-v3cg-7r9h-r2g6","summary":"Field-level security issue with .keyword fields in OpenSearch","modified":"2026-09-10T03:49:51.742235328Z","packages":[{"ecosystem":"Maven","name":"org.opensearch.plugin:opensearch-security","purl":"pkg:maven/org.opensearch.plugin/opensearch-security","ranges":["<1.3.8"],"fixed":["1.3.8"]},{"ecosystem":"Maven","name":"org.opensearch.plugin:opensearch-security","purl":"pkg:maven/org.opensearch.plugin/opensearch-security","ranges":[">=2.0.0 <2.5.0"],"fixed":["2.5.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}