CVE-2018-17954

CWE-269 — Improper Privilege Management3 documents3 sources
Severity
7.8HIGH
EPSS
0.0%
top 87.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Suse Suse Openstack Cloud 7Suse Suse Openstack Cloud 8Suse Suse Openstack Cloud 9+4 more
Timeline
PublishedApr 3
Latest updateMay 24

Description

An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3, ardana-. SUSE OpenSta…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 2.5 | Impact: 6.0

Affected Packages7 packages

▶CVEListV5suse/suse_openstack_cloud_crowbar_8crowbar-core — 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-
▶CVEListV5suse/suse_openstack_cloud_crowbar_9crowbar-core — 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-
▶CVEListV5suse/suse_openstack_cloud_7crowbar-core — 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-
▶CVEListV5suse/suse_openstack_cloud_8ardana-cinder — 8.0+git.1579279939.ee7da88-3.39.3, ardana-

🔴Vulnerability Details

2
GHSA
GHSA-m786-w84g-pcv9: A Least Privilege Violation vulnerability in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud C↗2022-05-24
▶
CVEList
crowbar provision leaks admin password to all nodes in cleartext↗2020-04-03
▶