CVE-2019-3683 - OpenCVE

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete arbitrary resources, contrary to expectations.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Hp	Helion Openstack
Suse	Keystone-json-assignment Openstack Cloud

Configuration 1 [-]

cpe:2.3:a:suse:openstack_cloud:8.0:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:a:suse:keystone-json-assignment:*:*:*:*:*:*:*:*

Configuration 3 [-]

cpe:2.3:a:hp:helion_openstack:8.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://bugzilla.suse.com/show_bug.cgi?id=1124864
https://www.suse.com/security/cve/CVE-2019-3683/

History

No history.

MITRE

Status: PUBLISHED

Assigner: suse

Published: 2020-01-17T11:10:12.100176Z

Updated: 2024-09-17T02:53:23.354Z

Reserved: 2019-01-03T00:00:00

Link: CVE-2019-3683

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2020-01-17T11:15:11.813

Modified: 2020-10-22T13:41:18.717

Link: CVE-2019-3683

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "SUSE Openstack Cloud 8", "vendor": "SUSE", "versions": [{"lessThan": "d7888c75505465490250c00cc0ef4bb1af662f9f", "status": "affected", "version": "keystone-json-assignment", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Kurt Garloff by SUSE"}], "datePublic": "2019-02-18T00:00:00", "descriptions": [{"lang": "en", "value": "The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full \"member\" role access to every project. This allowed these users to access, modify, create and delete arbitrary resources, contrary to expectations."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-01-17T11:10:12", "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1124864"}], "source": {"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1124864", "defect": ["1124864"], "discovery": "INTERNAL"}, "title": "keystone_json_assignment backend granted access to any project for users in user-project-map.json", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@suse.com", "DATE_PUBLIC": "2019-02-18T00:00:00.000Z", "ID": "CVE-2019-3683", "STATE": "PUBLIC", "TITLE": "keystone_json_assignment backend granted access to any project for users in user-project-map.json"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SUSE Openstack Cloud 8", "version": {"version_data": [{"version_affected": "<", "version_name": "keystone-json-assignment", "version_value": "d7888c75505465490250c00cc0ef4bb1af662f9f"}]}}]}, "vendor_name": "SUSE"}]}}, "credit": [{"lang": "eng", "value": "Kurt Garloff by SUSE"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full \"member\" role access to every project. This allowed these users to access, modify, create and delete arbitrary resources, contrary to expectations."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-732: Incorrect Permission Assignment for Critical Resource"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.suse.com/show_bug.cgi?id=1124864", "refsource": "CONFIRM", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1124864"}]}, "source": {"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1124864", "defect": ["1124864"], "discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T19:19:17.419Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1124864"}]}]}, "cveMetadata": {"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "cveId": "CVE-2019-3683", "datePublished": "2020-01-17T11:10:12.100176Z", "dateReserved": "2019-01-03T00:00:00", "dateUpdated": "2024-09-17T02:53:23.354Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:suse:openstack_cloud:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "1C3BEB21-4080-4258-B95C-562D717AED0B", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:suse:keystone-json-assignment:*:*:*:*:*:*:*:*", "matchCriteriaId": "5CA0DA3D-0522-4337-8CBF-3D68CD71C69E", "versionEndExcluding": "2019-02-18", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hp:helion_openstack:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "541BB602-443D-4D8E-A46F-5EC4A9702E17", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full \"member\" role access to every project. This allowed these users to access, modify, create and delete arbitrary resources, contrary to expectations."}, {"lang": "es", "value": "El paquete keystone-json-assignment en SUSE Openstack Cloud versi\u00f3n 8 antes del commit d7888c75505465490250c00cc0ef4bb1af662f9f, a cada usuario listado en el archivo /etc/keystone/user-project-map.json se le fue asignado el rol completo \"member\" para cada proyecto. Esto permiti\u00f3 a estos usuarios acceder, modificar, crear y eliminar recursos arbitrarios, contrariamente a lo esperado."}], "id": "CVE-2019-3683", "lastModified": "2020-10-22T13:41:18.717", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "meissner@suse.de", "type": "Secondary"}]}, "published": "2020-01-17T11:15:11.813", "references": [{"source": "meissner@suse.de", "tags": ["Issue Tracking", "Permissions Required"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1124864"}, {"source": "nvd@nist.gov", "tags": ["Vendor Advisory"], "url": "https://www.suse.com/security/cve/CVE-2019-3683/"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-732"}], "source": "meissner@suse.de", "type": "Secondary"}]}