CVE-2022-23451

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	openstack/barbican	Fixed in v14.0.0

References

https://access.redhat.com/security/cve/CVE-2022-23451Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2022878Issue Tracking, Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2025089Issue Tracking, Third Party Advisory
https://review.opendev.org/c/openstack/barbican/+/811236Patch, Third Party Advisory
https://storyboard.openstack.org/#%21/story/2009253
https://access.redhat.com/security/cve/CVE-2022-23451Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2022878Issue Tracking, Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2025089Issue Tracking, Third Party Advisory
https://review.opendev.org/c/openstack/barbican/+/811236Patch, Third Party Advisory
https://storyboard.openstack.org/#%21/story/2009253

Timeline

Published: Sep 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-234524.9An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. T CVE-2022-234537.8Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, comprom CVE-2022-234547.8Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, comprom CVE-2022-234557.8Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, comprom CVE-2022-234565.5Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.CVE-2022-234579.8ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the de CVE-2022-234586.1Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting CVE-2022-234599.8Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx use of the Value class may lead to memor CVE-2022-23464.3In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.CVE-2022-234607.5Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustio CVE-2022-234616.1Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attac CVE-2022-234627.5IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerabilit