Vulnerability CVE-2018-14432
Published: 2018-07-31

Description:
In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.

CVSS2 => (AV:N/AC:M/Au:S/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Redhat -> Openstack 
Openstack -> Keystone 
Debian -> Debian linux 

 References:
http://www.openwall.com/lists/oss-security/2018/07/25/2
http://www.securityfocus.com/bid/104930
https://access.redhat.com/errata/RHSA-2018:2523
https://access.redhat.com/errata/RHSA-2018:2533
https://access.redhat.com/errata/RHSA-2018:2543
https://www.debian.org/security/2018/dsa-4275
Copyright 2024, cxsecurity.com

 

Back to Top