CVE-2020-12691

Katalog CVE

CVSS 8.8 · High EPSS 4,9%

Kerentanan Incorrect Authorization pada openstack keystone, canonical ubuntu linux. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.

Rincian

Terbit di NVD

7 Mei 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

4,9% peluang dieksploitasi; lebih tinggi dari 91,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.openstack.org/ossa/OSSA-2020-004.html advisory vendor
• https://bugs.launchpad.net/keystone/+bug/1872733 patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/05/07/2 mailing list · advisory pihak ketiga
• https://usn.ubuntu.com/4480-1/ advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2020/05/06/5 mailing list · advisory pihak ketiga
• https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa%40%3Ccommits.dr...
• https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2%40%3Ccommits.dr...