CVE-2019-3683

Published: Jan 17, 2020Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete arbitrary resources, contrary to expectations.

Affected (3)

Products: Suse: Openstack Cloud, Keystone Json Assignment · Hp: Helion Openstack

2 products

Openstack Cloud

Keystone Json Assignment

1 product

Helion Openstack

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Suse Openstack Cloud	Version 8.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Suse Keystone Json Assignment	Before 2019-02-18

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Hp Helion Openstack	Version 8.0

Related CWEs

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (3)

https://bugzilla.suse.com/show_bug.cgi?id=1124864

Source: meissner@suse.de

Issue TrackingPermissions Required

https://www.suse.com/security/cve/CVE-2019-3683/

Source: nvd@nist.gov

Vendor Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1124864

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPermissions Required

Timeline

No history available yet.