CVEvulnerability
CVE-2022-23451
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-09-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Weaknesses
- CWE-863
Description
An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.
Affected configurations
• openstack barbican (< 14.0.0)
• redhat openstack platform 13.0
• redhat openstack platform 16.1
• redhat openstack platform 16.2
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://access.redhat.com/security/cve/CVE-2022-23451 Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2022878 Issue Tracking, Permissions Required
- https://bugzilla.redhat.com/show_bug.cgi?id=2025089 Issue Tracking, Third Party Advisory
- https://review.opendev.org/c/openstack/barbican/+/811236 Patch, Third Party Advisory
- https://storyboard.openstack.org/#%21/story/2009253 storyboard.openstack.org
- https://access.redhat.com/security/cve/CVE-2022-23451 Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2022878 Issue Tracking, Permissions Required
- https://bugzilla.redhat.com/show_bug.cgi?id=2025089 Issue Tracking, Third Party Advisory
- https://review.opendev.org/c/openstack/barbican/+/811236 Patch, Third Party Advisory
- https://storyboard.openstack.org/#%21/story/2009253 storyboard.openstack.org