What’s Vulnerable › Vulnerabilities

CVE-2022-23451

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-06 · updated 2026-06-17
• Weakness: CWE-863

Description

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

Affected products

• OpenStack Barbican: before 14.0.0 — fixed in 14.0.0
• nova_libvirt container provided by the Red Hat OpenStack Platform: 13.0, 16.1, 16.2

How to fix

Upgrade to a fixed version: OpenStack Barbican 14.0.0. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/security/cve/CVE-2022-23451
• https://bugzilla.redhat.com/show_bug.cgi?id=2022878
• https://bugzilla.redhat.com/show_bug.cgi?id=2025089
• https://review.opendev.org/c/openstack/barbican/+/811236
• https://storyboard.openstack.org/#%21/story/2009253
• https://access.redhat.com/security/cve/CVE-2022-23451
• https://bugzilla.redhat.com/show_bug.cgi?id=2022878
• https://bugzilla.redhat.com/show_bug.cgi?id=2025089
• https://review.opendev.org/c/openstack/barbican/+/811236
• https://storyboard.openstack.org/#%21/story/2009253

Get alerted when CVE-2022-23451 or the next vulnerability affects your stack