CVE-2015-3646

OpenStack Identity (Keystone) <2014.1.5-2014.2.4 - Info Disclosure

Title source: llm
STIX 2.1

Description

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.

References (4)

Core 4
Core References
Mailing List, Patch, Vendor Advisory mailing-list x_refsource_mlist
http://lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/74456
Third Party Advisory x_refsource_confirm
https://bugs.launchpad.net/keystone/+bug/1443598

Scores

EPSS 0.0018
EPSS Percentile 38.7%

Details

CWE
CWE-200
Status published
Products (3)
openstack/keystone 2014.1 - 2014.1.5
oracle/solaris 11.2
pypi/keystone 2011.3 - 2014.1.5PyPI
Published May 12, 2015
Tracked Since Feb 18, 2026