CVE-2016-7404

CRITICAL

Openstack Magnum < 5.0.0 - Information Disclosure

Title source: rule

Description

OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.

References (4)

Scores

CVSS v3 9.8
EPSS 0.0286
EPSS Percentile 86.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-200
Status published

Affected Products (2)

openstack/magnum
pypi/openstack-magnum < 5.0.0PyPI

Timeline

Published Jun 21, 2019
Tracked Since Feb 18, 2026