Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
keystone_json_assignment backend granted access to any project for users in user-project-map.json
Vulnerability Description
The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete arbitrary resources, contrary to expectations.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
关键资源的不正确权限授予
Vulnerability Title
SUSE Openstack Cloud keystone-json-assignment包命令注入漏洞
Vulnerability Description
SUSE OpenStack Cloud是德国SUSE公司的一套基于软件的企业级数据储存解决方案。 SUSE Openstack Cloud 8 commit d7888c75505465490250c00cc0ef4bb1af662f9f之前版本中的keystone-json-assignment包存在命令注入漏洞。攻击者可利用该漏洞访问、修改、创建和删除任意资源。
CVSS Information
N/A
Vulnerability Type
N/A