CVE-2019-19687

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

• CWE-522

• http://www.openwall.com/lists/oss-security/2019/12/11/8Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:4358
• https://bugs.launchpad.net/keystone/+bug/1855080Exploit, Third Party Advisory
• https://review.opendev.org/#/c/697355/Patch, Third Party Advisory
• https://review.opendev.org/#/c/697611/Patch, Third Party Advisory
• https://review.opendev.org/#/c/697731/Patch, Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2019-006.htmlVendor Advisory
• https://usn.ubuntu.com/4262-1/
• http://www.openwall.com/lists/oss-security/2019/12/11/8Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:4358
• https://bugs.launchpad.net/keystone/+bug/1855080Exploit, Third Party Advisory
• https://review.opendev.org/#/c/697355/Patch, Third Party Advisory
• https://review.opendev.org/#/c/697611/Patch, Third Party Advisory
• https://review.opendev.org/#/c/697731/Patch, Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2019-006.htmlVendor Advisory
• https://usn.ubuntu.com/4262-1/

Published

Dec 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19680A file-extension filtering vulnerability in Proofpoint Enter…8.8
• CVE-2019-19681Pandora FMS 7.x suffers from remote code execution vulnerabi…8.8
• CVE-2019-19682nopCommerce through 4.20 allows XSS in the SaveStoreMappings…4.8
• CVE-2019-19683RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerab…9.1
• CVE-2019-19684nopCommerce v4.2.0 allows privilege escalation via file uplo…8.8
• CVE-2019-19685RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerab…8.8
• CVE-2019-19688A privilege escalation vulnerability in Trend Micro HouseCal…7.8
• CVE-2019-19689Trend Micro HouseCall for Home Networks (versions below 5.3.…7.8
• CVE-2019-1969A vulnerability in the implementation of the Simple Network …5.3
• CVE-2019-19690Trend Micro Mobile Security for Android (Consumer) versions …9.8
• CVE-2019-19691A vulnerability in Trend Micro Apex One and OfficeScan XG co…4.9
• CVE-2019-19692Trend Micro Apex One (2019) is affected by a cross-site scri…6.1