What is the CVSS score of CVE-2024-55886?

CVE-2024-55886 has a CVSS 3.1 base score of 6.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Amazon CVE-2024-55886

MEDIUM

Improper Authentication (CWE-287)

2024-12-12 security-advisories@github.com

Authentication Bypass Amazon Opensearch Data Prepper

6.9

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.9 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:H

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

CVE Published

Dec 12, 2024 - 20:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists in the OpenTelemetry Logs source in Data Prepper starting inversion 2.1.0 and prior to version 2.10.2 where some custom authentication plugins will not perform authentication. This allows unauthorized users to ingest OpenTelemetry Logs data under certain conditions. This vulnerability does not affect the built-in http_basic authentication provider in Data Prepper. Pipelines which use the http_basic authentication provider continue to require authentication. The vulnerability exists only for custom implementations of Data Prepper’s GrpcAuthenticationProvider authentication plugin which implement the getHttpAuthenticationService() method instead of getAuthenticationInterceptor(). Data Prepper 2.10.2 contains a fix for this issue. For those unable to upgrade, one may use the built-in http_basic authentication provider in Data Prepper and/or add an authentication proxy in front of one's Data Prepper instances running the OpenTelemetry Logs source.

AnalysisAI

OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists in the OpenTelemetry Logs source in Data Prepper starting inversion 2.1.0 and prior to version 2.10.2 where some custom authentication plugins will not perform authentication. This allows unauthorized users to ingest OpenTelemetry Logs data under certain conditions. This vulnerability does not affect the built-in http_basic authentication provider in Data Prepper. Pipelines which use the http_basic authentication provider continue to require authentication. The vulnerability exists only for custom implementations of Data Prepper’s GrpcAuthenticationProvider authentication plugin which implement the getHttpAuthenticationService() method instead of getAuthenticationInterceptor(). Data Prepper 2.10.2 contains a fix for this issue. For those unable to upgrade, one may use the built-in http_basic authentication provider in Data Prepper and/or add an authentication proxy in front of one's Data Prepper instances running the OpenTelemetry Logs source. Affected products include: Amazon Opensearch Data Prepper. Version information: version 2.1.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.