Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved via the interface drivers. Then, all users of the requesting OpenStack project can view the access key. This enables the attacker to target any resource that the user has access to. This can be done to even "admin" users, compromising the ceph administrator. This flaw affects Ceph versions prior to 14.2.16, 15.x prior to 15.2.8, and 16.x prior to 16.2.0.
CVSS Information
N/A
Vulnerability Type
不充分的凭证保护机制
Vulnerability Title
OpenStack 安全漏洞
Vulnerability Description
OpenStack是美国国家航空航天局（National Aeronautics and Space Administration）和美国Rackspace公司合作研发的一个云平台管理项目。 OpenStack Manila 存在安全漏洞，该漏洞源于DescriptionUser凭据可能会被OpenStack Manila的本地CephFS消费者操纵和窃取，从而导致潜在的特权升级。
CVSS Information
N/A
Vulnerability Type
N/A