CVE-2022-23451

2022-09-0617:18:52

CWE-863

redhat

www.cve.org

openstack-barbican

authorization flaw

secret metadata

unauthorized modification

denial of service

protected resources

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

46.9%

JSON

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

CNA Affected

[
  {
    "product": "openstack/barbican",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in v14.0.0"
      }
    ]
  }
]