CVE-2024-28752 vulnerability in opensearch

Security
,
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Opensearch 2.13.0

Describe the issue:
A client of ours, reported vulnerability CVE-2024-28752 in opensearch-security/cxf-core-4.0.3.jar

Configuration:

Relevant Logs or Screenshots:
https://nvd.nist.gov/vuln/detail/CVE-2024-28752

Could you please help me understand if the vulnerability is exploitable?

2

Please see the Security tab on GitHub for how to report security issues. They generally like to avoid keeping these public until they’re solved.

Currently it says:

If you discover a potential security issue in this project we ask that you notify OpenSearch Security directly via email to security@opensearch.org. Please do not create a public GitHub issue.

1 Like
3

Thankyou @landon_lslc for your response. Will mail them.