Barbican authorization flaw before v14.0.0
An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-23451US | high8.1OT elevated | — | ||
An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from a… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2022:5114WEB
- https://access.redhat.com/errata/RHSA-2022:8874WEB
- https://access.redhat.com/security/cve/CVE-2022-23451WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2022878WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2025089WEB
- https://github.com/advisories/GHSA-p2jg-q8hw-p7gcADVISORY
- https://github.com/openstack/barbicanPACKAGE
- https://github.com/openstack/barbican/commit/7d270bacbe29a90a10f1855abc3b50dac0f08022WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan