Vulnerability CVE-2019-19687
Published: 2019-12-09

Description:
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Type:

CWE-522

 (Insufficiently Protected Credentials)

CVSS2 => (AV:N/AC:M/Au:S/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Openstack -> Keystone 

 References:
http://www.openwall.com/lists/oss-security/2019/12/11/8
https://access.redhat.com/errata/RHSA-2019:4358
https://bugs.launchpad.net/keystone/+bug/1855080
https://review.opendev.org/#/c/697355/
https://review.opendev.org/#/c/697611/
https://review.opendev.org/#/c/697731/
https://security.openstack.org/ossa/OSSA-2019-006.html
Copyright 2024, cxsecurity.com

 

Back to Top