CVE-2021-38155
CVSS v3
7.5
HIGH
EPSS Score
1.2 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.
Technical details
- Published
- 2021-08-06
Frequently asked questions
What is CVE-2021-38155?
OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.
Is CVE-2021-38155 actively exploited?
Active exploitation of CVE-2021-38155 has not been confirmed. The EPSS score is 1.2%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2021-38155?
CVE-2021-38155 has a CVSS v3 base score of 7.5 (HIGH severity).
Is CVE-2021-38155 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2021 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).