CVE-2019-3683

keystone_json_assignment backend granted access to any project for users in user-project-map.json

State: Published
Severity: 8.8 High
Published: Jan 17, 2020
Updated: Sep 17, 2024
Reserved: Jan 3, 2019

Description

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete arbitrary resources, contrary to expectations.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	suse

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
SUSE Openstack Cloud 8SUSE	keystone-json-assignment to before d7888c75505465490250c00cc0ef4bb1af662f9fAffected

References

https://bugzilla.suse.com/show_bug.cgi?id=1124864

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.