CVE-2020-9543

Aliases:GHSA-jx7v-gmqc-6xrjPYSEC-2020-63
Advisory lineage Upstream: 0 Downstream: 9
Modified
Published: 12 Mar 2020, 16:40
Last modified:04 Aug 2024, 10:34

Vulnerability Summary

Overall Risk (default)
medium
43/100
CVSS Score
8.3 HIGH
v3.1 (nvd)
EPSS Score
0.27% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

12 Mar 2020, 16:40
Published
Vulnerability first disclosed
04 Aug 2024, 10:34
Last Modified
Vulnerability information updated

Description

OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks.

CVSS Metrics

  • v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
  • v3.1•HIGH•Score: 8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
  • v2.0•MEDIUM•Score: 6.5AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.27%• Percentile: 51%

Techniques & Countermeasures

  • CWE-276•Incorrect Default Permissions

    During installation, installed file permissions are set to allow anyone to modify those files.

Affected Systems

  • openstack•manila

    < 7.4.1 | ≥ 8.0.0, < 8.1.1 | ≥ 9.0.0, < 9.1.1

  • PyPI•manila

    < 7.4.1 | ≥ 8.0.0, < 8.1.1 | ≥ 9.0.0, < 9.1.1

References (8)