What is the OpenStack Keystone Credentials API vulnerability CVE-2019-19687?
This article is to share with you what the OpenStack Keystone Credentials API vulnerability CVE-2019-19687 refers to. The editor thinks it is very practical, so I share it with you to learn. I hope you can get something after reading this article. Let's take a look at it with the editor.
Overview of 0x00
Recently, foreign researcher Daniel 'f0o' Preussker reported a defect in the OpenStack component Keystone Credentials API. When enforce_scope is set to False in the deployment configuration of Keystone, the filtering operation related to the list credentials API becomes invalid, causing users with roles in the operating project to obtain all user credentials under the project, resulting in information disclosure.
0x01 scope of influence
Keystone
