GitHub Advisoryadvisory · PyPI

GHSA-xf8c-3cgx-fcwm Improper Access Control in novajoin

HIGH Published 2020-03-12 Modified 2024-09-26 Official page ↗
Aliases
CVE-2019-10138
Ecosystem
PyPI
Packages
novajoin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2020-03-12

Affected packages

• PyPI novajoin: < 1.1.1 → fixed in 1.1.1

Description

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.

Related

Alias · CVE (1)

  • CVE-2019-10138 A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References