GitHub Advisoryadvisory · PyPI

GHSA-jx7v-gmqc-6xrj OpenStack Manila Unprivileged users can retrieve, use and manipulate share networks

HIGH Published 2022-05-24 Modified 2024-09-30 Official page ↗
Aliases
CVE-2020-9543
Ecosystem
PyPI
Packages
manila
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-276
Reviewed
2024-04-29

Affected packages

• PyPI manila: < 7.4.1 → fixed in 7.4.1 • PyPI manila: >= 8.0.0, < 8.1.1 → fixed in 8.1.1 • PyPI manila: >= 9.0.0, < 9.1.1 → fixed in 9.1.1

Description

OpenStack Manila =8.0.0 =9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks.

Related

Alias · CVE (1)

  • CVE-2020-9543 OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References