CVE-2017-2673CWE-863

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone)

Medium · published July 19, 2018

CVSS v3.0
6.8
EPSS
2%
Percentile
81.4
In the wild
Unconfirmed
What it is

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.

The record
Technical detail
CVSS v3.0
6.8 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.02097 · 81.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2018-07-19T13:00Z
EPSS history
Timeline
  • 19 JUL 13:00Z
    An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone)
    cvelistv5