« Volver al listado

CVE-2021-38155

Estado: ModificadaAlta (7.5)—

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openstack — Keystone

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-38155",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-06T21:15:06.687",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2021/08/10/5",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://launchpad.net/bugs/1688137",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00007.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.openstack.org/ossa/OSSA-2021-003.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2021/08/10/5",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://launchpad.net/bugs/1688137",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00007.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.openstack.org/ossa/OSSA-2021-003.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected."
    },
    {
      "lang": "es",
      "value": "OpenStack Keystone versiones 10.x hasta 16.x anteriores a 16.0.2, versiones 17.x anteriores a 17.0.1, versiones 18.x anteriores a 18.0.1 y versiones 19.x anteriores a 19.0.1, permite una divulgación de información durante el bloqueo de cuentas (relacionado con las características de PCI DSS). Al adivinar el nombre de una cuenta y fallando en la autenticación múltiples veces, cualquier actor no autenticado podría tanto confirmar que la cuenta se presenta y obtener el UUID correspondiente de esa cuenta, que podría ser aprovechado para otros ataques no relacionados. Todas las implantaciones que permiten security_compliance.lockout_failure_attempts están afectadas"
    }
  ],
  "lastModified": "2026-06-17T04:01:35.487",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64EC21DE-CE8B-4F59-A3D4-0A6F50CC94C3",
              "versionEndExcluding": "16.0.2",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CBD90FD4-F74A-4B50-984B-88AC5053C72D",
              "versionEndExcluding": "17.0.1",
              "versionStartIncluding": "17.0.0"
            },
            {
              "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3EB12E55-F484-49F2-BFBF-6BA81D8645C6",
              "versionEndExcluding": "18.0.1",
              "versionStartIncluding": "18.0.0"
            },
            {
              "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E814845D-8600-4214-A9E4-7C8A330CC144",
              "versionEndExcluding": "19.0.1",
              "versionStartIncluding": "19.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}