CVE-2018-20170

OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory

Score

CVSS 3.0 5.3 Medium

Status

Modified - cve@mitre.org

Published

2018-12-17

Last modified

2024-11-14

Weaknesses

CWE-200

Affected products

• Keystone (Openstack)

References

• https://bugs.launchpad.net/keystone/+bug/1795800