8.8

CVE-2019-19687: openstack keystone Insufficiently Protected Credentials

CVSS: 8.8v3.1HighModified
AliasesGHSA-2j23-fwqm-mgwrPYSEC-2019-29RHSA-2019:4358
Published 09-12-2019Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2019-19687 is a high (CVSS 8.8) Insufficiently Protected Credentials vulnerability in openstack keystone. EPSS estimates a 1.78% chance of exploitation in the next 30 days, higher than 77.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
46/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (NVD)
EPSS score
1.78%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 1
RHEA-2020:0283

Timeline

  1. 09-12-2019
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

CVSS metrics

7 scores · 5 sources · 4 versions

EPSS trend

Probability

1.78%

Chance of exploitation in the next 30 days

Percentile

78%

Versus all other CVEs

30-day change

0.00 pp

From 1.78% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.78%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (bugs.launchpad.net)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat2 products
  • openstack-keystone< 1:15.0.1-0.20190720060412.5f27c4b.1.el8ost
  • python3-keystone< 1:15.0.1-0.20190720060412.5f27c4b.1.el8ost
Debian1 product
  • keystone< 2:16.0.0-5
Openstack1 product
PyPI1 product
  • keystone≥ 15.0.0, < 15.0.1 | ≥ 16.0.0, < 16.0.1 | < 16.0.1
Ubuntu1 product
  • keystone< 2:9.3.0-0ubuntu3.2 | < 2:13.0.2-0ubuntu1

5 vendors · 6 products

References

31 links
Show all 31 references