Information disclosure in Openstack Keystone

CVE-2015-3646

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.

Vulnerability class: Information Disclosure

EPSS: 0.029 (85.4th percentile) — read the EPSS interpretation.

Affected products

Openstack Keystone
Oracle Solaris — versions 11.2
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_MLIST, Patch, Mailing List)
cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)