title: crowbar provision leaks admin password to all nodes in cleartext
description: An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3, ardana-. SUSE OpenStack Cloud 9 ardana-ansible versions prior to 9.0+git.1581611758.f694f7d-3.16.1, ardana-. SUSE OpenStack Cloud Crowbar 8 crowbar-core versions prior to 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-. SUSE OpenStack Cloud Crowbar 9 crowbar-core versions prior to 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-.
problem types: CWE-269: Improper Privilege Management
affected:
{
vendor: SUSE
product: SUSE OpenStack Cloud 7
versions:
version: crowbar-core, status: affected, lessThan: 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-, versionType: custom
}
{
vendor: SUSE
product: SUSE OpenStack Cloud 8
versions:
version: ardana-cinder, status: affected, lessThan: 8.0+git.1579279939.ee7da88-3.39.3, ardana-, versionType: custom
}
{
vendor: SUSE
product: SUSE OpenStack Cloud 9
versions:
version: ardana-ansible, status: affected, lessThan: 9.0+git.1581611758.f694f7d-3.16.1, ardana-, versionType: custom
}
{
vendor: SUSE
product: SUSE OpenStack Cloud Crowbar 8
versions:
version: crowbar-core, status: affected, lessThan: 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-, versionType: custom
}
{
vendor: SUSE
product: SUSE OpenStack Cloud Crowbar 9
versions:
version: crowbar-core, status: affected, lessThan: 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
]