{"id":"CVE-2019-3683","details":"The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full \"member\" role access to every project. This allowed these users to access, modify, create and delete arbitrary resources, contrary to expectations.","modified":"2026-10-24T10:31:01.560006982Z","published":"2020-01-17T11:15:11.813Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"range":[{"fixed":"2019-02-18"}],"source":"CPE_RANGE"}],"vendor_product":"suse:keystone-json-assignment","cpes":["cpe:2.3:a:suse:keystone-json-assignment:*:*:*:*:*:*:*:*"]},{"extracted_events":[{"source":"CPE_STRING","range":[{"introduced":"8.0"},{"last_affected":"8.0"}]}],"vendor_product":"hp:helion_openstack","cpes":["cpe:2.3:a:hp:helion_openstack:8.0:*:*:*:*:*:*:*"]},{"vendor_product":"suse:openstack_cloud","cpes":["cpe:2.3:a:suse:openstack_cloud:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"range":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING"}]}]},"references":[{"type":"ADVISORY","url":"https://www.suse.com/security/cve/CVE-2019-3683/"},{"type":"REPORT","url":"https://bugzilla.suse.com/show_bug.cgi?id=1124864"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/suse-cloud/keystone-json-assignment","events":[{"introduced":"0"},{"fixed":"d7888c75505465490250c00cc0ef4bb1af662f9f"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"d7888c75505465490250c00cc0ef4bb1af662f9f"}],"source":"DESCRIPTION"}]}}],"versions":["0.0.3","0.0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3683.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}