CVE-2020-10755 — Insufficiently Protected Credentials in Redhat Openstack-cinder

CWE-522 — Insufficiently Protected Credentials10 documents8 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 59.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Openstack CinderRedhat Openstack-cinderRED HAT Openstack-cinder+1 more
Timeline
PublishedJun 10
Latest updateMay 24

Description

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the ``connection_info`` element in all Block Storage v3 Attachments API calls containing that element. This flaw e…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶PyPIopenstack/cinder14.0.0 — 14.1.0+2
▶NVDredhat/openstack-cinder15.0.0 — 15.2.0+2
▶Debianopenstack/cinder< 2:16.1.0-1+3
▶CVEListV5red_hat/openstack-cinderall openstack-cinder 15.x.x versions before openstack-cinder 15.2.0, all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0, all openstack-cinder versions before openstack-cinder 14.1.0+2

Also affects: Ubuntu Linux 18.04, 20.04

🔴Vulnerability Details

4
OSV
Openstack cinder Improper handling of ScaleIO backend credentials↗2022-05-24
▶
GHSA
Openstack cinder Improper handling of ScaleIO backend credentials↗2022-05-24
▶
CVEList
CVE-2020-10755: An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14↗2020-06-10
▶
OSV
CVE-2020-10755: An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14↗2020-06-10
▶

📋Vendor Advisories

3
Ubuntu
Cinder and os-brick vulnerability↗2020-07-07
▶
Red Hat
openstack-cinder: Improper handling of ScaleIO backend credentials↗2020-06-03
▶
Debian
CVE-2020-10755: cinder - An insecure-credentials flaw was found in all openstack-cinder versions before o...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-10755 openstack-cinder: Improper handling of ScaleIO backend credentials [openstack-rdo]↗2020-06-08
▶
Bugzilla
CVE-2020-10755 openstack-cinder: Improper handling of ScaleIO backend credentials↗2020-06-02
▶
CVE-2020-10755 — Insufficiently Protected Credentials | cvebase