CVE-2020-12690

Katalog CVE

CVSS 8.8 · High EPSS 1,9%

Kerentanan Insufficient Session Expiration pada openstack keystone. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.

Rincian

Terbit di NVD

7 Mei 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.openstack.org/ossa/OSSA-2020-005.html advisory vendor
• https://bugs.launchpad.net/keystone/+bug/1873290 patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/05/07/3 mailing list · advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2020/05/06/6 mailing list · advisory pihak ketiga
• https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa%40%3Ccommits.dr...
• https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2%40%3Ccommits.dr...
• https://usn.ubuntu.com/4480-1/