CVE-2019-10138

Published: Jul 30, 2019Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.

Affected (1)

Products: Python: Novajoin

Python

1 product

Novajoin

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Python Novajoin	Before 1.1.1

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (4)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://review.opendev.org/#/c/631240/

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://review.opendev.org/#/c/631240/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.