CVE-2023-6725 — MEDIUM (5.5)

Vulnerability Description

An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Openstack Platform	17.1

Related Weaknesses (CWE)

CWE-1220

References

https://access.redhat.com/errata/RHSA-2024:2736Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:2770Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-6725Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2249273Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:2736Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:2770Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-6725Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2249273Vendor Advisory

FAQ

What is CVE-2023-6725?

CVE-2023-6725 is a vulnerability with a CVSS score of 5.5 (MEDIUM). An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker wi...

How severe is CVE-2023-6725?

CVE-2023-6725 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-6725?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Openstack Platform.