Skip to content
CVE Tracker
Back

CVE-2018-17954

crowbar provision leaks admin password to all nodes in cleartext

Critical9.3EPSS 0.32%
Published
Updated
Reserved
Assigned by
microfocus

Description

An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3, ardana-. SUSE OpenStack Cloud 9 ardana-ansible versions prior to 9.0+git.1581611758.f694f7d-3.16.1, ardana-. SUSE OpenStack Cloud Crowbar 8 crowbar-core versions prior to 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-. SUSE OpenStack Cloud Crowbar 9 crowbar-core versions prior to 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-.

Scores

CVSS scores of CVE-2018-17954, by who scored it
Scored byCVSSScoreVector
microfocusCNA (assigner)3.1Critical9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVDNVD · Modified3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.32% · top 75% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

Affected products

  • SUSE · SUSE OpenStack Cloud 7

    • affected crowbar-core – < 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-

  • SUSE · SUSE OpenStack Cloud 8

    • affected ardana-cinder – < 8.0+git.1579279939.ee7da88-3.39.3, ardana-

  • SUSE · SUSE OpenStack Cloud 9

    • affected ardana-ansible – < 9.0+git.1581611758.f694f7d-3.16.1, ardana-

  • SUSE · SUSE OpenStack Cloud Crowbar 8

    • affected crowbar-core – < 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-

  • SUSE · SUSE OpenStack Cloud Crowbar 9

    • affected crowbar-core – < 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .