CVE - CVE-2017-12440

CVE-ID
CVE-2017-12440	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:100455 URL:http://www.securityfocus.com/bid/100455 CONFIRM:https://bugs.launchpad.net/ossn/+bug/1649333 CONFIRM:https://review.openstack.org/#/c/493823/ CONFIRM:https://review.openstack.org/#/c/493824/ CONFIRM:https://review.openstack.org/#/c/493826/ DEBIAN:DSA-3953 URL:http://www.debian.org/security/2017/dsa-3953 REDHAT:RHSA-2017:3227 URL:https://access.redhat.com/errata/RHSA-2017:3227 REDHAT:RHSA-2018:0315 URL:https://access.redhat.com/errata/RHSA-2018:0315
Assigning CNA
MITRE Corporation
Date Record Created
20170804	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20170804)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)