CVE-2023-1633 - Vulnerability Details

Vendors	Products
Openstack	Barbican
Redhat	Openstack Openstack Platform

Package	CPE	Advisory	Released Date
Red Hat OpenStack Platform 16.2
openstack-barbican-0:9.0.2-2.20230515185056.1cd585c.el8ost	cpe:/a:redhat:openstack:16.2::el8	RHSA-2023:6231	2023-11-08T00:00:00Z

Link	Providers
https://access.redhat.com/security/cve/CVE-2023-1633
https://bugzilla.redhat.com/show_bug.cgi?id=2181761
https://nvd.nist.gov/vuln/detail/CVE-2023-1633
https://www.cve.org/CVERecord?id=CVE-2023-1633

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-1633", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2023-03-25T17:59:57.293Z", "datePublished": "2023-09-24T00:09:50.215Z", "dateUpdated": "2024-09-24T15:00:33.599Z"}, "containers": {"cna": {"title": "Insecure barbican configuration file leaking credential", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials."}], "affected": [{"product": "openstack-barbican", "vendor": "n/a", "defaultStatus": "affected"}, {"vendor": "Red Hat", "product": "Red Hat OpenStack Platform 13 (Queens)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openstack-barbican", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:openstack:13"]}, {"vendor": "Red Hat", "product": "Red Hat OpenStack Platform 16.1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openstack-barbican", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openstack:16.1"]}, {"vendor": "Red Hat", "product": "Red Hat OpenStack Platform 16.2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openstack-barbican", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openstack:16.2"]}, {"vendor": "Red Hat", "product": "Red Hat OpenStack Platform 17.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openstack-barbican", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openstack:17.0"]}, {"product": "OpenStack RDO", "vendor": "RDO", "collectionURL": "https://repos.fedorapeople.org/repos/openstack/", "packageName": "openstack-barbican", "defaultStatus": "affected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-1633", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181761", "name": "RHBZ#2181761", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2023-04-21T00:00:00+00:00", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "timeline": [{"lang": "en", "time": "2023-03-25T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2023-04-21T00:00:00+00:00", "value": "Made public."}], "credits": [{"lang": "en", "value": "This issue was discovered by Ade Lee (Red Hat) and Grzegorz Grasza (Red Hat)."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2023-09-24T00:09:50.215Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:57:24.844Z"}, "title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-1633", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181761", "name": "RHBZ#2181761", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-24T15:00:26.781162Z", "id": "CVE-2023-1633", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T15:00:33.599Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-1633 (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

state : PUBLISHED (string)

assignerShortName : redhat (string)

dateReserved : 2023-03-25T17:59:57.293Z (string)

datePublished : 2023-09-24T00:09:50.215Z (string)

dateUpdated : 2024-09-24T15:00:33.599Z (string)

}

containers : { »

cna : { »

title : Insecure barbican configuration file leaking credential (string)

metrics : [ »

0 : { »

other : { »

content : { »

value : Moderate (string)

namespace : https://access.redhat.com/security/updates/classification/ (string)

}

type : Red Hat severity rating (string)

}

1 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : LOW (string)

baseScore : 6.6 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L (string)

version : 3.1 (string)

}

format : CVSS (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials. (string)

}

]

affected : [ »

0 : { »

product : openstack-barbican (string)

vendor : n/a (string)

defaultStatus : affected (string)

}

1 : { »

vendor : Red Hat (string)

product : Red Hat OpenStack Platform 13 (Queens) (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

packageName : openstack-barbican (string)

defaultStatus : unknown (string)

cpes : [ »

0 : cpe:/a:redhat:openstack:13 (string)

]

}

2 : { »

vendor : Red Hat (string)

product : Red Hat OpenStack Platform 16.1 (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

packageName : openstack-barbican (string)

defaultStatus : affected (string)

cpes : [ »

0 : cpe:/a:redhat:openstack:16.1 (string)

]

}

3 : { »

vendor : Red Hat (string)

product : Red Hat OpenStack Platform 16.2 (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

packageName : openstack-barbican (string)

defaultStatus : affected (string)

cpes : [ »

0 : cpe:/a:redhat:openstack:16.2 (string)

]

}

4 : { »

vendor : Red Hat (string)

product : Red Hat OpenStack Platform 17.0 (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

packageName : openstack-barbican (string)

defaultStatus : affected (string)

cpes : [ »

0 : cpe:/a:redhat:openstack:17.0 (string)

]

}

5 : { »

product : OpenStack RDO (string)

vendor : RDO (string)

collectionURL : https://repos.fedorapeople.org/repos/openstack/ (string)

packageName : openstack-barbican (string)

defaultStatus : affected (string)

}

]

references : [ »

0 : { »

url : https://access.redhat.com/security/cve/CVE-2023-1633 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

]

}

1 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2181761 (string)

name : RHBZ#2181761 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

]

}

]

datePublic : 2023-04-21T00:00:00+00:00 (string)

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-200 (string)

description : Exposure of Sensitive Information to an Unauthorized Actor (string)

lang : en (string)

type : CWE (string)

}

]

}

]

x_redhatCweChain : CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (string)

timeline : [ »

0 : { »

lang : en (string)

time : 2023-03-25T00:00:00+00:00 (string)

value : Reported to Red Hat. (string)

}

1 : { »

lang : en (string)

time : 2023-04-21T00:00:00+00:00 (string)

value : Made public. (string)

}

]

credits : [ »

0 : { »

lang : en (string)

value : This issue was discovered by Ade Lee (Red Hat) and Grzegorz Grasza (Red Hat). (string)

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2023-09-24T00:09:50.215Z (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T05:57:24.844Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://access.redhat.com/security/cve/CVE-2023-1633 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

1 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2181761 (string)

name : RHBZ#2181761 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-09-24T15:00:26.781162Z (string)

id : CVE-2023-1633 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-24T15:00:33.599Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-1633", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181761", "name": "RHBZ#2181761", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:57:24.844Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-1633", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-24T15:00:26.781162Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T15:00:30.342Z"}}], "cna": {"title": "Insecure barbican configuration file leaking credential", "credits": [{"lang": "en", "value": "This issue was discovered by Ade Lee (Red Hat) and Grzegorz Grasza (Red Hat)."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "n/a", "product": "openstack-barbican", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:13"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 13 (Queens)", "packageName": "openstack-barbican", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openstack:16.1"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 16.1", "packageName": "openstack-barbican", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:16.2"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 16.2", "packageName": "openstack-barbican", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:17.0"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 17.0", "packageName": "openstack-barbican", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"vendor": "RDO", "product": "OpenStack RDO", "packageName": "openstack-barbican", "collectionURL": "https://repos.fedorapeople.org/repos/openstack/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2023-03-25T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2023-04-21T00:00:00+00:00", "value": "Made public."}], "datePublic": "2023-04-21T00:00:00+00:00", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-1633", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181761", "name": "RHBZ#2181761", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "descriptions": [{"lang": "en", "value": "A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2023-09-24T00:09:50.215Z"}, "x_redhatCweChain": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}}, "cveMetadata": {"cveId": "CVE-2023-1633", "state": "PUBLISHED", "dateUpdated": "2024-09-24T15:00:33.599Z", "dateReserved": "2023-03-25T17:59:57.293Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2023-09-24T00:09:50.215Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://access.redhat.com/security/cve/CVE-2023-1633 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

1 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2181761 (string)

name : RHBZ#2181761 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T05:57:24.844Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-1633 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-09-24T15:00:26.781162Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-24T15:00:30.342Z (string)

}

]

cna : { »

title : Insecure barbican configuration file leaking credential (string)

credits : [ »

0 : { »

lang : en (string)

value : This issue was discovered by Ade Lee (Red Hat) and Grzegorz Grasza (Red Hat). (string)

}

]

metrics : [ »

0 : { »

other : { »

type : Red Hat severity rating (string)

content : { »

value : Moderate (string)

namespace : https://access.redhat.com/security/updates/classification/ (string)

}

1 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 6.6 (number)

attackVector : LOCAL (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : LOW (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

]

affected : [ »

0 : { »

vendor : n/a (string)

product : openstack-barbican (string)

defaultStatus : affected (string)

}

1 : { »

cpes : [ »

0 : cpe:/a:redhat:openstack:13 (string)

]

vendor : Red Hat (string)

product : Red Hat OpenStack Platform 13 (Queens) (string)

packageName : openstack-barbican (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

defaultStatus : unknown (string)

}

2 : { »

cpes : [ »

0 : cpe:/a:redhat:openstack:16.1 (string)

]

vendor : Red Hat (string)

product : Red Hat OpenStack Platform 16.1 (string)

packageName : openstack-barbican (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

defaultStatus : affected (string)

}

3 : { »

cpes : [ »

0 : cpe:/a:redhat:openstack:16.2 (string)

]

vendor : Red Hat (string)

product : Red Hat OpenStack Platform 16.2 (string)

packageName : openstack-barbican (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

defaultStatus : affected (string)

}

4 : { »

cpes : [ »

0 : cpe:/a:redhat:openstack:17.0 (string)

]

vendor : Red Hat (string)

product : Red Hat OpenStack Platform 17.0 (string)

packageName : openstack-barbican (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

defaultStatus : affected (string)

}

5 : { »

vendor : RDO (string)

product : OpenStack RDO (string)

packageName : openstack-barbican (string)

collectionURL : https://repos.fedorapeople.org/repos/openstack/ (string)

defaultStatus : affected (string)

}

]

timeline : [ »

0 : { »

lang : en (string)

time : 2023-03-25T00:00:00+00:00 (string)

value : Reported to Red Hat. (string)

}

1 : { »

lang : en (string)

time : 2023-04-21T00:00:00+00:00 (string)

value : Made public. (string)

}

]

datePublic : 2023-04-21T00:00:00+00:00 (string)

references : [ »

0 : { »

url : https://access.redhat.com/security/cve/CVE-2023-1633 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

]

}

1 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2181761 (string)

name : RHBZ#2181761 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-200 (string)

description : Exposure of Sensitive Information to an Unauthorized Actor (string)

}

]

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2023-09-24T00:09:50.215Z (string)

}

x_redhatCweChain : CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (string)

}

cveMetadata : { »

cveId : CVE-2023-1633 (string)

state : PUBLISHED (string)

dateUpdated : 2024-09-24T15:00:33.599Z (string)

dateReserved : 2023-03-25T17:59:57.293Z (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

datePublished : 2023-09-24T00:09:50.215Z (string)

assignerShortName : redhat (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:barbican:-:*:*:*:*:*:*:*", "matchCriteriaId": "596EFC6C-4D91-4EDF-9EC6-1C58EB485C5E", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*", "matchCriteriaId": "DCC81071-B46D-4F5D-AC25-B4A4CCC20C73", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:*", "matchCriteriaId": "4B3000D2-35DF-4A93-9FC0-1AD3AB8349B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openstack_platform:17.0:*:*:*:*:*:*:*", "matchCriteriaId": "F7076B1E-0529-43CC-828B-45C2ED11F9F6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials."}, {"lang": "es", "value": "Se encontr\u00f3 una falla de fuga de credenciales en OpenStack Barbican. Esta falla permite que un atacante autenticado local lea el archivo de configuraci\u00f3n y obtenga acceso a credenciales sensibles."}], "id": "CVE-2023-1633", "lastModified": "2024-11-21T07:39:35.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.7, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-24T01:15:43.760", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2023-1633"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181761"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2023-1633"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181761"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:openstack:barbican:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 596EFC6C-4D91-4EDF-9EC6-1C58EB485C5E (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:* (string)

matchCriteriaId : DCC81071-B46D-4F5D-AC25-B4A4CCC20C73 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 4B3000D2-35DF-4A93-9FC0-1AD3AB8349B8 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:redhat:openstack_platform:17.0:*:*:*:*:*:*:* (string)

matchCriteriaId : F7076B1E-0529-43CC-828B-45C2ED11F9F6 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials. (string)

}

1 : { »

lang : es (string)

value : Se encontró una falla de fuga de credenciales en OpenStack Barbican. Esta falla permite que un atacante autenticado local lea el archivo de configuración y obtenga acceso a credenciales sensibles. (string)

}

]

id : CVE-2023-1633 (string)

lastModified : 2024-11-21T07:39:35.337 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : LOW (string)

baseScore : 6.6 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 4.7 (number)

source : secalert@redhat.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 5.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-09-24T01:15:43.760 (string)

references : [ »

0 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://access.redhat.com/security/cve/CVE-2023-1633 (string)

}

1 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Issue Tracking (string)

1 : Third Party Advisory (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=2181761 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://access.redhat.com/security/cve/CVE-2023-1633 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Third Party Advisory (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=2181761 (string)

}

]

sourceIdentifier : secalert@redhat.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-200 (string)

}

]

source : secalert@redhat.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-522 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"acknowledgement": "This issue was discovered by Ade Lee (Red Hat) and Grzegorz Grasza (Red Hat).", "affected_release": [{"advisory": "RHSA-2023:6231", "cpe": "cpe:/a:redhat:openstack:16.2::el8", "package": "openstack-barbican-0:9.0.2-2.20230515185056.1cd585c.el8ost", "product_name": "Red Hat OpenStack Platform 16.2", "release_date": "2023-11-08T00:00:00Z"}], "bugzilla": {"description": "openstack-barbican: Insecure Barbican configuration file leaking credential", "id": "2181761", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181761"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "status": "verified"}, "cwe": "CWE-200", "details": ["A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.", "A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials."], "name": "CVE-2023-1633", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "openstack-barbican", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.1", "fix_state": "Will not fix", "package_name": "openstack-barbican", "product_name": "Red Hat OpenStack Platform 16.1"}, {"cpe": "cpe:/a:redhat:openstack:17.0", "fix_state": "Out of support scope", "package_name": "openstack-barbican", "product_name": "Red Hat OpenStack Platform 17.0"}], "public_date": "2023-04-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-1633\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-1633"], "threat_severity": "Moderate"}

{

acknowledgement : This issue was discovered by Ade Lee (Red Hat) and Grzegorz Grasza (Red Hat). (string)

affected_release : [ »

0 : { »

advisory : RHSA-2023:6231 (string)

cpe : cpe:/a:redhat:openstack:16.2::el8 (string)

package : openstack-barbican-0:9.0.2-2.20230515185056.1cd585c.el8ost (string)

product_name : Red Hat OpenStack Platform 16.2 (string)

release_date : 2023-11-08T00:00:00Z (string)

}

]

bugzilla : { »

description : openstack-barbican: Insecure Barbican configuration file leaking credential (string)

id : 2181761 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2181761 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 6.6 (string)

cvss3_scoring_vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L (string)

status : verified (string)

}

cwe : CWE-200 (string)

details : [ »

0 : A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials. (string)

1 : A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials. (string)

]

name : CVE-2023-1633 (string)

package_state : [ »

0 : { »

cpe : cpe:/a:redhat:openstack:13 (string)

fix_state : Out of support scope (string)

package_name : openstack-barbican (string)

product_name : Red Hat OpenStack Platform 13 (Queens) (string)

}

1 : { »

cpe : cpe:/a:redhat:openstack:16.1 (string)

fix_state : Will not fix (string)

package_name : openstack-barbican (string)

product_name : Red Hat OpenStack Platform 16.1 (string)

}

2 : { »

cpe : cpe:/a:redhat:openstack:17.0 (string)

fix_state : Out of support scope (string)

package_name : openstack-barbican (string)

product_name : Red Hat OpenStack Platform 17.0 (string)

}

]

public_date : 2023-04-21T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2023-1633 https://nvd.nist.gov/vuln/detail/CVE-2023-1633 (string)

]

threat_severity : Moderate (string)

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object