CVE-2023-45807: 
Java vulnerability analysis and mitigation

OpenSearch, a community-driven open source fork of Elasticsearch and Kibana, was found to have a vulnerability in the implementation of tenant permissions in OpenSearch Dashboards. The issue was discovered and disclosed on October 16, 2023, affecting versions prior to 1.3.14.0 and 2.11.0.0. The vulnerability allows authenticated users with read-only access to a tenant to perform unauthorized create, edit, and delete operations on index metadata of dashboards and visualizations (GitHub Advisory).

The vulnerability has been assigned CVE-2023-45807 with a CVSS v3.1 base score of 5.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The issue specifically affects the metadata operations while maintaining proper enforcement of read-only permissions for indexing and updating documents. The vulnerability is classified under CWE-281 (Improper Preservation of Permissions) (NVD).

The vulnerability impacts the index metadata of dashboards and visualizations within affected tenants, potentially making them unavailable. Importantly, the issue does not affect actual index data, and does not provide additional read access to data users don't already have. The scope is limited to metadata operations within tenants that users already have read-only access to (GitHub Advisory).

The vulnerability requires network access and low privilege levels (authenticated access with read-only permissions) to exploit. No user interaction is needed for exploitation, though the attack complexity is considered low (NVD).

The vulnerability has been patched in OpenSearch versions 1.3.14 and 2.11.0. As a temporary workaround, administrators can mitigate the issue by disabling the tenants functionality for the cluster. Users are advised to upgrade to the patched versions (GitHub Advisory).