CVE-2018-14432

CWE-200 — Information Exposure8 documents7 sources
Severity
5.3MEDIUM
EPSS
1.1%
top 21.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Openstack KeystoneDebian Debian LinuxRedhat Openstack
Timeline
PublishedJul 31
Latest updateMay 13

Description

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages3 packages

▶NVDopenstack/keystone< 11.0.4+2
▶Debiankeystone< 2:13.0.0-7+3
▶NVDredhat/openstack10, 12, 13+2

Also affects: Debian Linux 9.0

Patches

Patch: www.openwall.com ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-v25x-mmfh-g7w6: In the Federation component of OpenStack Keystone before 11↗2022-05-13
▶
CVEList
CVE-2018-14432: In the Federation component of OpenStack Keystone before 11↗2018-07-31
▶
OSV
CVE-2018-14432: In the Federation component of OpenStack Keystone before 11↗2018-07-31
▶

📋Vendor Advisories

2
Red Hat
openstack-keystone: Information Exposure through /v3/OS-FEDERATION/projects↗2018-07-25
▶
Debian
CVE-2018-14432: keystone - In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13....↗2018
▶

💬Community

2
Bugzilla
CVE-2018-14432 openstack-keystone: Information Exposure through /v3/OS-FEDERATION/projects [openstack-rdo]↗2018-07-25
▶
Bugzilla
CVE-2018-14432 openstack-keystone: Information Exposure through /v3/OS-FEDERATION/projects↗2018-07-20
▶
CVE-2018-14432 (MEDIUM CVSS 5.3) | In the Federation component of Open | cvebase.io