Homepage

Missing Authentication for Critical Function The advisory has been revoked - it doesn't affect any version of package aodh  (opens in a new tab)

Threat Intelligence

Exploit Maturity
Not Defined
EPSS
0.53% (78th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Missing Authentication for Critical Function vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-UBUNTU1804-AODH-661167
  • published18 Aug 2017
  • disclosed18 Aug 2017
Report a new vulnerability Found a mistake?

Introduced: 18 Aug 2017

CVE-2017-12440  (opens in a new tab)
CWE-306  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:18.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream aodh package and not the aodh package as distributed by Ubuntu.

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.