An authenticated cross-site scripting vulnerability in the OpenSearch Dashboards observability plugin allows attackers to compromise other users' sessions via malicious saved assets.

The vulnerability is a cross-site scripting (XSS) flaw (CWE-79) caused by improper input validation, allowing an authenticated user to inject malicious web content into saved assets that are later rendered by other users.

A successful exploit could allow an attacker to hijack user sessions, perform unauthorized actions on behalf of other users, or steal sensitive information from the Dashboards interface. With a CVSS score of 8.7, this represents a high risk to organizational data and administrative control within the OpenSearch environment.

Immediate Action: Update to OpenSearch Dashboards versions 3.4 or 2.19.6, or the latest available patched version, to resolve the input validation flaw.

Proactive Monitoring: Audit saved objects and user activity within OpenSearch Dashboards for suspicious scripts or unexpected asset configurations.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the browser environment.

Public Exploit Available: Unknown

Given the high impact of session compromise, administrators should prioritize updating the affected OpenSearch plugins immediately. Ensure that write permissions for saved objects are restricted to authorized users to prevent the creation of malicious assets.