id: PYSEC-2020-63
details: OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers
  to view, update, delete, or share resources that do not belong to them, because
  of a context-free lookup of a UUID. Attackers may also create resources, such as
  shared file systems and groups of shares on such share networks.
affected:
- package:
    name: manila
    ecosystem: PyPI
    purl: pkg:pypi/manila
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 7.4.1
    - introduced: 8.0.0
    - fixed: 8.1.1
    - introduced: 9.0.0
    - fixed: 9.1.1
  versions:
  - 4.0.2
  - 5.0.2
  - 5.0.3
  - 5.1.0
  - 6.1.0
  - 6.2.0
  - 6.3.0
  - 6.3.1
  - 6.3.2
  - 7.0.0
  - 7.1.0
  - 7.2.0
  - 7.3.0
  - 7.4.0
  - 8.0.0
  - 8.0.1
  - 8.1.0
  - 9.0.0
  - 9.1.0
references:
- type: WEB
  url: https://bugs.launchpad.net/manila/+bug/1861485
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2020/03/12/1
- type: WEB
  url: https://security.openstack.org/ossa/OSSA-2020-002.html
- type: ADVISORY
  url: https://github.com/advisories/GHSA-jx7v-gmqc-6xrj
aliases:
- CVE-2020-9543
- GHSA-jx7v-gmqc-6xrj
modified: "2020-07-14T17:27:00Z"
published: "2020-03-12T17:15:00Z"