CVE-2022-23451

State: Published
Severity: Not scored
Published: Sep 6, 2022
Updated: Aug 3, 2024
Reserved: Jan 19, 2022

Description

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

Scores

The record has no CVSS score.

Weaknesses

CWE-863 Incorrect Authorization.

Affected Products

Product	Versions
openstack/barbicann/a	Fixed in v14.0.0Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=2025089
https://bugzilla.redhat.com/show_bug.cgi?id=2022878
https://storyboard.openstack.org/#%21/story/2009253
https://review.opendev.org/c/openstack/barbican/+/811236
https://access.redhat.com/security/cve/CVE-2022-23451

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.