-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stemmed from the system returning AccountLocked exceptions with user UUIDs during failed authentication attempts. The patch in keystone/notifications.py modified the exception handling in the wrapper function to replace AccountLocked with a generic Unauthorized error. This confirms the original function's role in leaking the sensitive exception. The code diff explicitly shows the addition of checks for AccountLocked in this function, making it the clear source of the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| keystone | pip | >= 10.0, < 16.0.2 | 16.0.2 |
| keystone | pip | >= 17.0, < 17.0.1 | 17.0.1 |
| keystone | pip | >= 18.0, < 18.0.1 | 18.0.1 |
| keystone | pip | >= 19.0, < 19.0.1 | 19.0.1 |
Ongoing coverage of React2Shell