CVE-2018-14432
Medium
Description
In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Redhat Openstack
PublishedJul 31, 2018
First seenJul 31, 2018
How to fix
Update
- openstack keystone11.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat openstack | 10, 12, 13 | — |
| debian debian_linux | 9.0 | — |
| openstack keystone | v < 11.0.4, 12.0.0, 13.0.0 | 11.0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.