-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing project isolation in share network database queries. The commit diff shows the critical addition of 'project_only=True' to the model_query in _network_get_query. This parameter enforces tenant isolation in OpenStack's policy framework. Prior to the fix, the absence of this check allowed context-free UUID lookups across projects. The tests (test_api.py) were also modified to use elevated contexts for cross-project operations, confirming the default API behavior lacked proper scoping.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| manila | pip | < 7.4.1 | 7.4.1 |
| manila | pip | >= 8.0.0, < 8.1.1 | 8.1.1 |
| manila | pip | >= 9.0.0, < 9.1.1 | 9.1.1 |
KEV Misses 88% of Exploited CVEs- Get the report