NetSight
IP …
medium4.0

CVE-2014-3621

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive c…

Impact

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Affected products

VendorProductAffected versions
OpenstackKeystone
from 2013.2 before 2013.2.3
from 2014.1 before 2014.1.2.1
CanonicalUbuntu Linux
Version 14.04
RedhatOpenstack
Versions 5.0, 4.0

Weakness classification

CWE-200

References