CVE-2022-23451: Incorrect Authorization
(updated )
An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.
References
- access.redhat.com/security/cve/CVE-2022-23451
- bugzilla.redhat.com/show_bug.cgi?id=2022878
- bugzilla.redhat.com/show_bug.cgi?id=2025089
- github.com/advisories/GHSA-p2jg-q8hw-p7gc
- github.com/openstack/barbican/commit/7d270bacbe29a90a10f1855abc3b50dac0f08022
- nvd.nist.gov/vuln/detail/CVE-2022-23451
- review.opendev.org/c/openstack/barbican/+/811236
- storyboard.openstack.org/
Code Behaviors & Features
Detect and mitigate CVE-2022-23451 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →