Vulnerability · Published Sep 1, 2022 · Assigned by redhat
CVE-2022-23452
Medium 4.9
In plain English
A medium-severity incorrect authorization in openstack/barbican. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)4.9Medium
Exploit odds (30 days)1.3%top 29.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | barbican | 1:14.0.0~rc1-2 | DEBIAN-CVE-2022-23452 |
| Debian:13 | barbican | 1:14.0.0~rc1-2 | DEBIAN-CVE-2022-23452 |
| Debian:14 | barbican | 1:14.0.0~rc1-2 | DEBIAN-CVE-2022-23452 |
| PyPI | barbican | 14.0.0 | GHSA-6p2h-rjj7-2j63 |
| PyPI | barbican | 14.0.0 | PYSEC-2026-785 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | openstack/barbican | Fixed in v14.0.0 |
Weakness: CWE-863
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2025090 x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=2022908 x_refsource_MISC
- https://storyboard.openstack.org/#%21/story/2009297 x_refsource_MISC
- https://review.opendev.org/c/openstack/barbican/+/814200 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2022-23452 x_refsource_MISC