VDB
CVE-2017-16613
CVE-2017-16613
PUBLISHED
CVSS 9.800000190734863 CRITICAL
An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allows attackers to bypass authentication by inserting a token into an X-Auth-Token header of a new request. NOTE: github.com/openstack/swauth URLs do not mean that Swauth is maintained by an official OpenStack project team.
EPSS 8.42% · 94.6th percentile
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
8.42%
94.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | swauth | 0, 1.0.4-0ubuntu1.16.04.1, 1.0.4-0ubuntu1 |
Timeline
- Nov 21, 2017 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Mar 1, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 4, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
- Jan 9, 2023 EPSS Score
- Mar 13, 2023 EPSS Score
- May 15, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-16613 third-party-advisory
- https://bugs.launchpad.net/swift/+bug/1655781 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-16613 third-party-advisory