CVE-2022-23451

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

• CWE-863
• CWE-863

• https://access.redhat.com/security/cve/CVE-2022-23451Issue Tracking, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2022878Issue Tracking, Permissions Required
• https://bugzilla.redhat.com/show_bug.cgi?id=2025089Issue Tracking, Third Party Advisory
• https://review.opendev.org/c/openstack/barbican/+/811236Patch, Third Party Advisory
• https://storyboard.openstack.org/#%21/story/2009253
• https://access.redhat.com/security/cve/CVE-2022-23451Issue Tracking, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2022878Issue Tracking, Permissions Required
• https://bugzilla.redhat.com/show_bug.cgi?id=2025089Issue Tracking, Third Party Advisory
• https://review.opendev.org/c/openstack/barbican/+/811236Patch, Third Party Advisory
• https://storyboard.openstack.org/#%21/story/2009253

Published

Sep 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23446A improper control of a resource through its lifetime in For…4.4
• CVE-2022-23447An improper limitation of a pathname to a restricted directo…7.5
• CVE-2022-23448A vulnerability has been identified in SIMATIC Energy Manage…7.8
• CVE-2022-23449A vulnerability has been identified in SIMATIC Energy Manage…7.3
• CVE-2022-2345Use After Free in GitHub repository vim/vim prior to 9.0.004…7.8
• CVE-2022-23450A vulnerability has been identified in SIMATIC Energy Manage…9.8
• CVE-2022-23452An authorization flaw was found in openstack-barbican, where…4.9
• CVE-2022-23453Potential security vulnerabilities have been identified in H…7.8
• CVE-2022-23454Potential security vulnerabilities have been identified in H…7.8
• CVE-2022-23455Potential security vulnerabilities have been identified in H…7.8
• CVE-2022-23456Potential arbitrary file deletion vulnerability has been ide…5.5
• CVE-2022-23457ESAPI (The OWASP Enterprise Security API) is a free, open so…9.8