GitHub Advisoryadvisory · PyPI

GHSA-p2jg-q8hw-p7gc Barbican authorization flaw before v14.0.0

HIGH Published 2022-09-07 Modified 2022-09-15 Official page ↗
Aliases
CVE-2022-23451
Ecosystem
PyPI
Packages
barbican
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-863
Reviewed
2022-09-15

Affected packages

• PyPI barbican: < 14.0.0 → fixed in 14.0.0

Description

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

Related

Alias · CVE (1)

  • CVE-2022-23451 An authorization flaw was found in openstack-barbican. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References