Shulou(Shulou.com)05/31 Report--

This article is to share with you what the OpenStack Keystone Credentials API vulnerability CVE-2019-19687 refers to. The editor thinks it is very practical, so I share it with you to learn. I hope you can get something after reading this article. Let's take a look at it with the editor.

Overview of 0x00

Recently, foreign researcher Daniel 'f0o' Preussker reported a defect in the OpenStack component Keystone Credentials API. When enforce_scope is set to False in the deployment configuration of Keystone, the filtering operation related to the list credentials API becomes invalid, causing users with roles in the operating project to obtain all user credentials under the project, resulting in information disclosure.

0x01 scope of influence

Keystone

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.