Description
Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OpenSearch OpenSearch
Default version status: unaffected
2.8 to ≤ 3.6affected
Amazon Amazon OpenSearch Service
Default version status: unaffected
2.9 to ≤ 3.5affected