OpenStack Identity Keystone Exposure of Sensitive Information
The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2014-3621US | medium4.0 | — | ||
The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://rhn.redhat.com/errata/RHSA-2014-1688.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-1789.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-1790.htmlWEB
- http://www.openwall.com/lists/oss-security/2014/09/16/10WEB
- http://www.ubuntu.com/usn/USN-2406-1WEB
- https://access.redhat.com/errata/RHSA-2014:1688WEB
- https://access.redhat.com/errata/RHSA-2014:1789WEB
- https://access.redhat.com/errata/RHSA-2014:1790WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan