#VU82112 Improper Authorization in Ceph - CVE-2023-43040

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU82112

#VU82112 Improper Authorization in Ceph - CVE-2023-43040

Published: October 17, 2023 / Updated: August 2, 2024


Vulnerability identifier: #VU82112
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2023-43040
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
Ceph
Software vendor:
Red Hat Inc.

Description

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to improper authorization in radogw API gateway in Ceph when processing POST requests. A remote unprivileged user can write to any bucket(s) accessible by a given key if a POST form-data contains a key called "bucket" with a value matching the bucket's name used to sign the request.


Remediation

Install updates from vendor's website.

External links