GitHub Advisoryadvisory · PyPI

GHSA-8v8f-vc72-pmhc OpenStack Identity Keystone Exposure of Sensitive Information

MEDIUM Published 2022-05-13 Modified 2024-05-14 Official page ↗
Aliases
CVE-2014-3621
Ecosystem
PyPI
Packages
keystone
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2024-05-14

Affected packages

• PyPI keystone: < 8.0.0a0 → fixed in 8.0.0a0

Description

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Related

Alias · CVE (1)

  • CVE-2014-3621 The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References