CVE-2020-10755
June 10, 2020
An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the "connection_info" element in all Block Storage v3 Attachments API calls containing that element. This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume. Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API, should an attacker discover the Management API endpoint. Source: OpenStack project
Affected Packages
os-brick (PYTHON):
Affected version(s) >=3.0.0 <3.0.2Fix Suggestion:
Update to version 3.0.2os-brick (PYTHON):
Affected version(s) >=2.8.0 <2.8.6Fix Suggestion:
Update to version 2.8.6cinder (PYTHON):
Affected version(s) >=14.0.0 <14.1.0Fix Suggestion:
Update to version 14.1.0cinder (PYTHON):
Affected version(s) =16.0.0 <16.1.0Fix Suggestion:
Update to version 16.1.0os-brick (PYTHON):
Affected version(s) >=2.10.0 <2.10.4Fix Suggestion:
Update to version 2.10.4cinder (PYTHON):
Affected version(s) >=15.0.0 <15.2.0Fix Suggestion:
Update to version 15.2.0Additional Notes
The description of this vulnerability differs from MITRE.
Related Resources (9)
Do you need more information?
Contact UsCVSS v4
Base Score:
7.1
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
CVSS v2
Base Score:
4.3
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
Weakness Type (CWE)
Insufficiently Protected Credentials
EPSS
Base Score:
0.32
