CVE-2017-2621

MEDIUM

OpenStack Orchestration <8.0.0, 6.1.0, 7.0.2 - Info Disclosure

Title source: llm

Description

An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information.

References (4)

[Broken Link, Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/96280

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2017:1243

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2017:1464

[Issue Tracking, Vendor Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2621

Scores

CVSS v3 5.5

EPSS 0.0007

EPSS Percentile 21.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-552 CWE-532

Status published

Affected Products (3)

openstack/heat < 8.0.0

redhat/openstack

redhat/openstack

Timeline

Published Jul 27, 2018

Tracked Since Feb 18, 2026