OpenStack Manila Unprivileged users can retrieve, use and manipulate share networks

ÉLEVÉE 8.3CVE-2020-9543 · GHSA-jx7v-gmqc-6xrj · PYSEC-2020-63 · Published 12/03/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
manila PyPI	`≥ 8.0.0, < 8.1.1≥ 9.0.0, < 9.1.1< 7.4.1`	`8.1.19.1.17.4.1`
manila openstack	`≥ 8.0.0, < 8.1.1≥ 9.0.0, < 9.1.1< 7.4.1`	`8.1.19.1.17.4.1`

Description

OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-9543 · ADVISORY
openstack/manila commit 947315f · WEB
bugs.launchpad.net/manila/+bug/1861485 · WEB
openstack/manila · PACKAGE
pypa/advisory-database · WEB
opendev.org/openstack/manila/commit/947315f0903c823b0fdd9d99c60078814587272c · WEB
security.openstack.org/ossa/OSSA-2020-002.html · WEB
openwall.com/lists/oss-security/2020/03/12/1 · WEB
GitHub Advisory GHSA-jx7v-gmqc-6xrj · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

manila

PyPI

≥ 8.0.0, < 8.1.1≥ 9.0.0, < 9.1.1< 7.4.1

8.1.19.1.17.4.1

manila

openstack

≥ 8.0.0, < 8.1.1≥ 9.0.0, < 9.1.1< 7.4.1

8.1.19.1.17.4.1

Description

NVD description