CVE-2018-14432

    Dashboard / Vulnerabilities / CVE-2018-14432

    CVE-2018-14432

    Published: 31 Jul 2018Last Modified: 8 Jul 2026

    Summary:

    Details: In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.

    References: http://www.securityfocus.com/bid/104930, https://access.redhat.com/errata/RHSA-2018:2523, https://access.redhat.com/errata/RHSA-2018:2533, https://access.redhat.com/errata/RHSA-2018:2543, https://www.debian.org/security/2018/dsa-4275, http://www.openwall.com/lists/oss-security/2018/07/25/2

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ade177ad357d28746ab4203e56a74e6e1e89c074

    Affected versions

    12.0.0
    12.0.0.0rc1
    12.0.0.0b3
    12.0.0.0b2
    12.0.0.0b1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High