CVE-2019-3683CWE-732

keystone_json_assignment backend granted access to any project for users in user-project-map.json

High · published January 17, 2020

CVSS v3.1
8.8
EPSS
1%
Percentile
60.4
In the wild
Unconfirmed
What it is

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete arbitrary resources, contrary to expectations.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00935 · 60.4th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2020-01-17T11:10Z
EPSS history
Timeline
  • 17 JAN 11:10Z
    keystone_json_assignment backend granted access to any project for users in user-project-map.json
    cvelistv5