Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

manila

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7PyPIAmendedPublished

    OpenStack Manila Unprivileged users can retrieve, use and manipulate share networks

    CVE-2020-9543 · GHSA-jx7v-gmqc-6xrj

    Affected
    • PyPI manila < 7.4.1; >= 8.0.0, < 8.1.1; >= 9.0.0, < 9.1.1
    Fixed in
    8.1.19.1.17.4.1· Vendor fix available
    Issue
    OpenStack Manila <7.4.1, =8.0.0 <8.1.1, and =9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks.

    Recommended action: Upgrade to 9.1.1, 8.1.1 or 7.4.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →