CVE-2019-10138CWE-284

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform

High · published July 30, 2019

CVSS v3.0
7.1
EPSS
1%
Percentile
63.1
In the wild
Unconfirmed
What it is

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.

The record
Technical detail
CVSS v3.0
7.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01028 · 63.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2019-07-30T16:16Z
EPSS history
Timeline
  • 30 JUL 16:16Z
    A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform
    cvelistv5