CVE-2015-3646
published 2015-05-12CVE-2015-3646: OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote…
medium4CVSS 3.1
AVNACLAuSCPINAN
OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | keystone | < keystone 2015.1.0-1 (bookworm) | keystone 2015.1.0-1 (bookworm) |
| openstack | keystone | >= 0 < 2015.1.0-1 | 2015.1.0-1 |
| openstack | keystone | >= 0 < 2015.1.0-1 | 2015.1.0-1 |
| openstack | keystone | >= 0 < 2015.1.0-1 | 2015.1.0-1 |
| openstack | keystone | >= 0 < 2015.1.0-1 | 2015.1.0-1 |
| openstack | keystone | >= 2011.3 < 2014.1.5 | 2014.1.5 |
| openstack | keystone | >= 2014.1 < 2014.1.5 | 2014.1.5 |
| openstack | keystone | >= 2014.2 < 2014.2.4 | 2014.2.4 |
| openstack | keystone | >= 2014.2.0 < 2014.2.4 | 2014.2.4 |
| oracle | solaris | — | — |
CVSS provenance
nvd4.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
osv4.0MEDIUM