8.3

CVE-2020-9543: openstack manila Incorrect Default Permissions

Modified
AliasesSUSE-SU-2020:0659-1SUSE-SU-2020:0660-1GHSA-jx7v-gmqc-6xrj
Published 12-03-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-9543 is a high (CVSS 8.3) Incorrect Default Permissions vulnerability in openstack manila. EPSS estimates a 1.34% chance of exploitation in the next 30 days, higher than 71.3% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
8.3/10
010
High · v3.1 (NVD)
EPSS score
1.34%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
SUSE-SU-2020:1066-1SUSE-SU-2020:1190-1

Timeline

  1. 12-03-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks.

CVSS metrics

7 scores · 5 sources · 3 versions

EPSS trend

Probability

1.34%

Chance of exploitation in the next 30 days

Percentile

71%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.34% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (bugs.launchpad.net)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse11 products
  • openstack-manila-doc&distro=HPE Helion OpenStack 8< 5.1.1~dev2-3.23.1
  • openstack-manila-doc&distro=SUSE OpenStack Cloud 8< 5.1.1~dev2-3.23.1
  • openstack-manila-doc&distro=SUSE OpenStack Cloud Crowbar 8< 5.1.1~dev2-3.23.1
  • openstack-manila&distro=HPE Helion OpenStack 8< 5.1.1~dev2-3.23.1
  • openstack-manila&distro=SUSE OpenStack Cloud 8< 5.1.1~dev2-3.23.1
Redhat5 products
  • openstack-manila< 1:8.1.1-0.20200311070441.17b29e2.el8ost | < 1:9.1.2-0.20200405045746.f071a43.el8ost | < 1:6.3.2-3.el7ost
  • openstack-manila-share< 1:8.1.1-0.20200311070441.17b29e2.el8ost | < 1:9.1.2-0.20200405045746.f071a43.el8ost | < 1:6.3.2-3.el7ost
  • python-manila< 1:6.3.2-3.el7ost
  • python-manila-tests< 1:6.3.2-3.el7ost
  • python3-manila< 1:8.1.1-0.20200311070441.17b29e2.el8ost | < 1:9.1.2-0.20200405045746.f071a43.el8ost
Debian1 product
  • manila< 1:9.0.0-5
Openstack1 product
  • manila< 7.4.1 | ≥ 8.0.0, < 8.1.1 | ≥ 9.0.0, < 9.1.1
PyPI1 product
  • manila< 7.4.1 | ≥ 8.0.0, < 8.1.1 | ≥ 9.0.0, < 9.1.1
Ubuntu1 product
  • manilaAll versions (No fix recorded)

6 vendors · 20 products

References

27 links
Show all 27 references