Privilege Escalation

2020-06-2405:07:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.005 Low

EPSS

Percentile

76.6%

JSON

openstack keystone is vulnerable to privilege escalation. The library does not properly enforce the role parameters associated to an OAuth1 access token. A keystone token containing every role assignment is assigned to a low-privileged user, granting the user more access than required.

CPENameOperatorVersion
keystonele16.0.0.0rc2
keystonele15.0.0
openstack-keystoneeq15.0.1__0.20190720060412.5f27c4b.el8ost
openstack-keystoneeq16.0.0__1.el8
openstack-keystoneeq16.0.1__0.20200224223521.40b7de8.el8ost
openstack-keystoneeq15.0.1__0.20191211040448.5ad8a33.el8ost
openstack-keystoneeq15.0.1__0.20190720060412.5f27c4b.1.el8ost
openstack-keystoneeq16.0.1__0.20191030053432.d5f9c68.el8ost
openstack-keystoneeq16.0.1__0.20191210095025.bd3f637.el8ost
keystone:bioniceq2:13.0.0-0ubuntu1

Name	Operator	Version
keystone	le	16.0.0.0rc2
keystone	le	15.0.0
openstack-keystone	eq	15.0.1__0.20190720060412.5f27c4b.el8ost
openstack-keystone	eq	16.0.0__1.el8
openstack-keystone	eq	16.0.1__0.20200224223521.40b7de8.el8ost
openstack-keystone	eq	15.0.1__0.20191211040448.5ad8a33.el8ost
openstack-keystone	eq	15.0.1__0.20190720060412.5f27c4b.1.el8ost
openstack-keystone	eq	16.0.1__0.20191030053432.d5f9c68.el8ost
openstack-keystone	eq	16.0.1__0.20191210095025.bd3f637.el8ost
keystone:bionic	eq	2:13.0.0-0ubuntu1