CVE-2022-23451

Incorrect Authorization in pypi/barbican

Identifiers

GHSA-p2jg-q8hw-p7gc, CVE-2022-23451

Package Slug

pypi/barbican

Vulnerability

Incorrect Authorization

Description

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

Affected Versions

All versions before 14.0.0

Solution

Upgrade to version 14.0.0 or above.

Last Modified

2022-09-15

source