CVE-2022-23451

EUVD-2022-6888
An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 61%
Affected Products (NVD)
VendorProductVersion
openstackbarbican
𝑥
< 14.0.0
redhatopenstack_platform
13.0
redhatopenstack_platform
16.1
redhatopenstack_platform
16.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
barbican
bookworm
1:15.0.1-2
fixed
bullseye
no-dsa
bullseye (security)
vulnerable
buster
no-dsa
sid
1:19.0.0-1
fixed
stretch
no-dsa
trixie
1:19.0.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
barbican
bionic
Fixed 1:6.0.1-0ubuntu1.1
released
focal
Fixed 1:10.1.0-0ubuntu2.1
released
impish
Fixed 2:13.0.0-0ubuntu1.2
released
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
ignored
xenial
needed
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2022-23451
https://bugzilla.redhat.com/show_bug.cgi?id=2022878
https://bugzilla.redhat.com/show_bug.cgi?id=2025089
https://review.opendev.org/c/openstack/barbican/+/811236
https://storyboard.openstack.org/#%21/story/2009253
https://access.redhat.com/security/cve/CVE-2022-23451
https://bugzilla.redhat.com/show_bug.cgi?id=2022878
https://bugzilla.redhat.com/show_bug.cgi?id=2025089
https://review.opendev.org/c/openstack/barbican/+/811236
https://storyboard.openstack.org/#%21/story/2009253