CVE-2022-23452

MEDIUM

OpenStack Barbican < 14.0.0 - Incorrect Authorization via Admin Role

Title source: llm
STIX 2.1

Description

An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.

References (5)

Core 5
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2025090
Issue Tracking, Permissions Required, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2022908
Various Sources x_refsource_misc
https://storyboard.openstack.org/#%21/story/2009297
Patch, Third Party Advisory x_refsource_misc
https://review.opendev.org/c/openstack/barbican/+/814200
Third Party Advisory x_refsource_misc
https://access.redhat.com/security/cve/CVE-2022-23452

Scores

CVSS v3 4.9
EPSS 0.0044
EPSS Percentile 63.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-863
Status published
Products (3)
openstack/barbican < 14.0.0
pypi/barbican 0 - 14.0.0PyPI
redhat/openstack_platform 16.1
Published Sep 01, 2022
Tracked Since Feb 18, 2026