NVD

Id
25302  
Name
CVE-2015-3646  
Description
OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2015-05-12  
Modified Date
2016-12-05  
Seq
2015-3646  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
133899 25302 CVE-2015-3646 [openstack-announce] 20150505 [OSSA 2015-008] Potential Keystone cache backend password leak in log (CVE-2015-3646)  View
133900 25302 CVE-2015-3646 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html  View
133901 25302 CVE-2015-3646 74456  View
133902 25302 CVE-2015-3646 https://bugs.launchpad.net/keystone/+bug/1443598  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
7365 JVNDB-2015-002685 OpenStack Identity におけるパスワードを取得される脆弱性 OpenStack Identity (Keystone) は、backend_argument 設定のオプションコンテンツを記録するため、パスワードを取得され、その他重要なバックエンドの情報を取得される脆弱性が存在します。 CVE-2015-3646 80871 CVE-2015-3646 25302 4 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002685.html 2015-04-13 2015-06-19 View