ByteOS Network

NVD Vulnerability Details :

CVE-2024-53916

Deferred

Source-cve@mitre.org

Published At-25 Nov, 2024 | 00:15

Updated At-15 Apr, 2026 | 00:35

In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check for changing network tags. An unprivileged tenant is able to change (add and clear) tags on network objects that do not belong to the tenant, and this action is not subjected to the proper policy authorization check. This affects 23 before 23.2.1, 24 before 24.0.2, and 25 before 25.0.1.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Type: Secondary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses

CWE ID	Type	Source
CWE-754	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-754

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://github.com/openstack/neutron/blob/363ffa6e9e1ab5968f87d45bc2f1cb6394f48b9f/neutron/extensions/tagging.py#L138-L232	cve@mitre.org	N/A
https://review.opendev.org/c/openstack/neutron/+/935883	cve@mitre.org	N/A
https://review.opendev.org/q/project:openstack/neutron	cve@mitre.org	N/A
https://security.openstack.org/ossa/OSSA-2024-005.html	cve@mitre.org	N/A
http://www.openwall.com/lists/oss-security/2024/12/03/1	af854a3a-2127-422b-91ae-364da2661108	N/A