CVE-2023-1633: openstack barbican
CVSS: 6.6v3.1MediumModified
AliasesGHSA-6qqp-4vm3-359vPYSEC-2026-1213RHSA-2023:6231
Published 24-09-2023Last modified 24-09-2024
Vulnerability summary
CVE-2023-1633 is a medium (CVSS 6.6) vulnerability in openstack barbican. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.4% of scored vulnerabilities.
CVSS score
6.6/10
010
Medium · v3.1 (CVE.org)EPSS score
0.19%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 24-09-2023PublishedVulnerability first disclosed.
- 24-09-2024Last modifiedVulnerability information updated.
Description
A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 6.6Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:LSources4 sources · 5.5–6.6
- OSV · PypiEcosystem advisory · calculated6.6MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
- OSV · Red hatEcosystem advisory · calculated6.6MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
0.00 pp
From 0.19% on 19-09-2026
19-09-202619-10-2026
EPSS score0.19%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Redhat2 products
- openstack_platform16.1 | 16.2 | 17.0
- openstack-barbican< 0:9.0.2-2.20230515185056.1cd585c.el8ost
Openstack1 product
- barbicanna
PyPI1 product
- barbican≤ 16.0.0
3 vendors · 4 products
References
10 links- access.redhat.com/security/cve/CVE-2023-1633VDB EntryX Refsource REDHATWEBREPORTThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2181761Issue TrackingX Refsource REDHATWEBREPORTThird Party Advisory
- pypi.org/project/barbicanPACKAGE