GitHub Advisoryadvisory · PyPI

GHSA-hm3x-jwwf-jpr9 Exposure of Sensitive Information to an Unauthorized Actor in OpenStack tripleo-heat-templates

MEDIUM Published 2022-03-24 Modified 2022-03-31 Official page ↗
Aliases
CVE-2021-4180
Ecosystem
PyPI
Packages
tripleo-heat-templates
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-668
Reviewed
2022-03-31

Affected packages

• PyPI tripleo-heat-templates: < 11.6.1 → fixed in 11.6.1

Description

An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the `www_authenticate_uri parameter` (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. A patch is available on the `master` branch and anticipated to be part of version 11.6.1.

Related

Alias · CVE (1)

  • CVE-2021-4180 An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References