Information disclosure in Openstack Keystone

CVE-2014-3621

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Vulnerability class: Information Disclosure

EPSS: 0.021 (79.9th percentile) — read the EPSS interpretation.

Affected products

Openstack Keystone
Canonical Ubuntu_linux — versions 14.04
Redhat Enterprise_linux — versions 6.0, 7.0
Redhat Openstack — versions 5.0, 4.0
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch, Mailing List, Third Party Advisory)
secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_CONFIRM, Exploit, Third Party Advisory, Issue Tracking)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)