CVE-2019-10138

HIGH

8.8

Description

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published7/30/2019

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

python:novajoin

Weaknesses (CWE)

CWE-284

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138(secalert@redhat.com)

https://review.opendev.org/#/c/631240/(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138(af854a3a-2127-422b-91ae-364da2661108)

https://review.opendev.org/#/c/631240/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.