CVE-2020-12691

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 15.0.1 OpenStack Keystone version 16.0.0

Description An issue allows any authenticated user to create an EC2 credential for themselves for a project they have a specified role on. The user can then update the credential user and project, enabling them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, effectively granting that user global admin privileges.

Recommendations For OpenStack Keystone versions prior to 15.0.1, update to version 15.0.1 or later. For OpenStack Keystone version 16.0.0, consider disabling the EC2 credential creation feature until a patch is available.