CVE-2022-23451
openstack/barbican
HIGH 8.1
En bref
- Source
- NVD
- EPSS
- EPSS 1.25 % · centile 69 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.
Faiblesses (CWE)
- CWE-863 — Autorisation incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-p2jg-q8hw-p7gc — Barbican authorization flaw before v14.0.0
- PYSEC-2026-786 — Barbican authorization flaw before v14.0.0
Références européennes
- ENISA EUVD · EUVD-2022-6888
- GCVE · GCVE-0-2022-23451
Configurations affectées (CPE NVD)
cpe:2.3:a:openstack:barbican:*:*:*:*:*:*:*:*< 14.0.0cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| openstack/barbican | affected Fixed in v14.0.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |