CVE-2018-20170

OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST…

published December 17, 2018

CVSS
—
EPSS
1%
Percentile
65.7
In the wild
Unconfirmed
What it is

OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01120 · 65.7th percentile
Published
2018-12-17T06:00Z
EPSS history
Timeline
  • 17 DEC 06:00Z
    OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST…
    cvelistv5