VDB
CVE-2017-16613
CVE-2017-16613
PUBLISHED
An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allows attackers to bypass authentication by inserting a token into an X-Auth-Token header of a new request. NOTE: github.com/openstack/swauth URLs do not mean that Swauth is maintained by an official OpenStack project team.
EPSS 2.35% · 85.2th percentile
Risk Scores
EPSS Score
2.35%
85.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | swauth | 0, 1.0.4-0ubuntu1.16.04.1, 1.0.4-0ubuntu1 |
Exploit Intelligence
Timeline
- Nov 21, 2017 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Jan 8, 2023 EPSS Score
- Mar 11, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-16613 third-party-advisory
- https://bugs.launchpad.net/swift/+bug/1655781 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-16613 third-party-advisory