SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2019-19687

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API.

HIGH 8.8EPSS 1.78%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.78%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

CVSS 3.1
8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
1.78% probability · 77th percentile
CISA KEV
Not listed
Weakness
CWE-522
Affected
openstack/keystone
Source
cve@mitre.org

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.