diff --git a/advisories/github-reviewed/2022/05/GHSA-p258-xmh3-72pv/GHSA-p258-xmh3-72pv.json b/advisories/github-reviewed/2022/05/GHSA-p258-xmh3-72pv/GHSA-p258-xmh3-72pv.json index ae628a014d6..c493eecb98e 100644 --- a/advisories/github-reviewed/2022/05/GHSA-p258-xmh3-72pv/GHSA-p258-xmh3-72pv.json +++ b/advisories/github-reviewed/2022/05/GHSA-p258-xmh3-72pv/GHSA-p258-xmh3-72pv.json @@ -1,14 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-p258-xmh3-72pv", - "modified": "2023-02-08T18:04:25Z", + "modified": "2025-04-13T23:18:20Z", "published": "2022-05-17T04:41:34Z", "aliases": [ "CVE-2014-0167" ], "summary": "OpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests", "details": "The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.", - "severity": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U" + } + ], "affected": [ { "package": { @@ -65,7 +70,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-862" + ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-02-08T18:04:25Z",