PT-2020-5962 · Huawei · Fusionsphere Openstack

Published 2020-06-17 · Updated 2020-06-22 · CVE-2020-9225

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version 6.5.1

Description The issue is related to improper permissions management. The software fails to correctly assign privileges when an actor attempts to perform an action, which could allow a user to perform operations beyond their assigned privilege. Successful exploitation may enable an attacker to elevate their privileges.

Recommendations For FusionSphere OpenStack version 6.5.1, consider restricting access to sensitive operations until a proper fix is applied to ensure correct privilege assignment. As a temporary workaround, review and manually adjust user privileges to prevent unauthorized actions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2021-02138

CVE-2020-9225

Affected Products

Fusionsphere Openstack

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-9225 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20200617-01-fusionsphere-en · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02138 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9225 · Vendor Advisory