CVE-2020-12690: openstack keystone Insufficient Session Expiration
Vulnerability summary
CVE-2020-12690 is a high (CVSS 8.8) Insufficient Session Expiration vulnerability in openstack keystone. EPSS estimates a 1.90% chance of exploitation in the next 30 days, higher than 79.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 06-05-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · PypiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.90%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.90% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- keystone< 2:17.0.0~rc2-1
Openstack1 product
- keystone< 15.0.1 | 16.0.0
PyPI1 product
- keystone≥ 16.0.0.0rc1, < 16.0.0 | < 15.0.1
Ubuntu1 product
- keystoneAll versions (No fix recorded) | < 2:13.0.4-0ubuntu1
4 vendors · 4 products
References
17 links- www.openwall.com/lists/oss-security/2020/05/06/6X Refsource MISCWEBREPORTMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2020/05/07/3Mailing ListX Refsource MLISTWEBThird Party Advisory
