6.5

CVE-2023-2088: redhat openstack Expected Behavior Violation

CVSS: 6.5v3.1MediumModified
AliasesRHSA-2023:3156RHSA-2023:3157RHSA-2023:3158
Published 12-05-2023Last modified 04-11-2025
Open JSON

Vulnerability summary

CVE-2023-2088 is a medium (CVSS 6.5) Expected Behavior Violation vulnerability in redhat openstack. EPSS estimates a 1.20% chance of exploitation in the next 30 days, higher than 67.6% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.20%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 5
DLA-3871-1USN-6073-5USN-6073-6USN-6073-7USN-6073-8USN-6073-9

Timeline

  1. 12-05-2023
    PublishedVulnerability first disclosed.
  2. 04-11-2025
    Last modifiedVulnerability information updated.

Description

A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

1.20%

Chance of exploitation in the next 30 days

Percentile

68%

Versus all other CVEs

30-day change

0.00 pp

From 1.20% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat28 products
  • openstackna
  • openstack-cinder< 1:15.4.0-1.20230510003501.58f0e73.el8ost | < 1:18.2.1-0.20230509200451.1776695.el9ost | < 1:15.6.1-2.20230310075425.a19c1c9.el8ost
  • openstack-nova< 1:20.4.1-1.20221005193232.el8ost | < 1:23.2.2-0.20221209190754.7074ac0.el9ost | < 1:20.6.2-2.20230308185149.el8ost | < 1:17.0.13-41.el7ost
  • openstack-nova-api< 1:20.4.1-1.20221005193232.el8ost | < 1:23.2.2-0.20221209190754.7074ac0.el9ost | < 1:20.6.2-2.20230308185149.el8ost | < 1:17.0.13-41.el7ost
  • openstack-nova-cells< 1:17.0.13-41.el7ost
Ubuntu5 products
  • cinderAll versions (No fix recorded) | < 2:16.4.2-0ubuntu2.3 | < 2:20.1.0-0ubuntu2.1 | < 2:20.2.0-0ubuntu1.1
  • ironicAll versions (No fix recorded) | < 1:20.1.0-0ubuntu1.1
  • novaAll versions (No fix recorded) | < 2:21.2.4-0ubuntu2.3 | < 3:25.1.0-0ubuntu2.1 | < 3:25.1.1-0ubuntu1.1
  • python-glance-storeAll versions (No fix recorded) | < 2.0.0-0ubuntu4.1 | < 3.0.0-0ubuntu1.1 | < 3.0.0-0ubuntu1.3
  • python-os-brickAll versions (No fix recorded) | < 3.0.8-0ubuntu1.1 | < 5.2.2-0ubuntu1 | < 5.2.2-0ubuntu1.2
Debian4 products
  • cinder< 2:21.1.0-3
  • nova< 2:26.1.0-4
  • python-glance-store< 4.1.0-4
  • python-os-brick< 4.1.0-3

3 vendors · 37 products

References

29 links
Show all 29 references