CVE-2022-23451
openstack/barbican
HIGH 8.1
At a glance
- Source
- NVD
- EPSS
- EPSS 1.25 % · percentile 69 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.
Weaknesses (CWE)
- CWE-863 — Incorrect Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-p2jg-q8hw-p7gc — Barbican authorization flaw before v14.0.0
- PYSEC-2026-786 — Barbican authorization flaw before v14.0.0
European references
- ENISA EUVD · EUVD-2022-6888
- GCVE · GCVE-0-2022-23451
Affected configurations (NVD CPE)
cpe:2.3:a:openstack:barbican:*:*:*:*:*:*:*:*< 14.0.0cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| openstack/barbican | affected Fixed in v14.0.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |