CVE-2023-6725: redhat openstack_platform

Vulnerability summary

CVE-2023-6725 is a medium (CVSS 5.5) vulnerability in redhat openstack_platform. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.3% of scored vulnerabilities.

Timeline

1. 15-03-2024
   PublishedVulnerability first disclosed.
2. 25-02-2026
   Last modifiedVulnerability information updated.

Description

An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information.

• CWE-1220Insufficient Granularity of Access ControlThe product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.