CVE-2022-23451

Katalog CVE

CVSS 8.1 · High EPSS 1,3%

Kerentanan Incorrect Authorization pada openstack barbican, redhat openstack platform. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

Rincian

Terbit di NVD

6 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 68,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://review.opendev.org/c/openstack/barbican/+/811236 patch · advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2022-23451 issue tracking · advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2025089 issue tracking · advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2022878 issue tracking · permissions required
• https://storyboard.openstack.org/#%21/story/2009253