CVE-2019-3683

Description

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full member role access to every project. This allowed these users to access, modify, create and delete arbitrary resources, contrary to expectations.

Risk Information

Base Score

8.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.272

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2019-3683 are affected in helion_openstack 8.0	NCM
Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2019-3683)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234