Improper handling of exceptional conditions in OpenSearch - CVE-2022-41917
Published: December 12, 2024
Vulnerability identifier: #VU101751
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-41917
CWE-ID: CWE-755
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to incorrect error handling in the REST API. A remote user can trick the victim into opening a specially crafted input to exploit this vulnerability to read partial file information, and use this information to launch further attacks against the affected system.
Affected software
OpenSearch
Cognos Dashboards on Cloud Pak for Data
Cognos Dashboards on Cloud Pak for Data
How to mitigate CVE-2022-41917
Install updates from vendor's website.
OpenSearch - addressed in versions 1.3.7, 2.4.0
Cognos Dashboards on Cloud Pak for Data - update to 5.1
Cognos Dashboards on Cloud Pak for Data - update to 5.1