{"cve":"CVE-2017-16613","nvd":{"published":"2017-11-21T13:29:00.267","modified":"2026-06-17T01:09:34.280","status":"Modified","description":"An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allows attackers to bypass authentication by inserting a token into an X-Auth-Token header of a new request. NOTE: github.com/openstack/swauth URLs do not mean that Swauth is maintained by an official OpenStack project team.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-287"],"references":["http://www.securityfocus.com/bid/101926","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882314","https://bugs.launchpad.net/swift/+bug/1655781","https://github.com/openstack/swauth/commit/70af7986265a3defea054c46efc82d0698917298","https://www.debian.org/security/2017/dsa-4044"],"products":["debian:debian_linux","openstack:swauth","openstack:swift"],"source":"nvd","synced_at":"2026-10-19T20:47:01.408438353+00:00"},"epss":{"cve":"CVE-2017-16613","score":0.08422,"percentile":0.94993,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-qhq8-xwqv-pvv9","url":"https://osv.dev/vulnerability/GHSA-qhq8-xwqv-pvv9","summary":"OpenStack Swauth object/proxy server writing Auth Token to log file","modified":"2024-10-28T14:53:45.092254Z","packages":[{"ecosystem":"PyPI","name":"swauth","purl":"pkg:pypi/swauth","ranges":["<1.3.0"],"fixed":["1.3.0"]}]},{"id":"PYSEC-2017-84","url":"https://osv.dev/vulnerability/PYSEC-2017-84","summary":"","modified":"2026-06-10T17:02:42.879386574Z","packages":[{"ecosystem":"PyPI","name":"swauth","purl":"pkg:pypi/swauth","ranges":["<1.3.0"],"fixed":["1.3.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}