CVE-2014-1948

2014-02-1415:55:00

CWE-255

[email protected]

web.nvd.nist.gov

cve-2014-1948

openstack

glance

icehouse

url leakage

swift store

log leakage

information security

6 Medium

AI Score

Confidence

Low

2.6 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:H/Au:N/C:P/I:P/A:N

0.0004 Low

EPSS

Percentile

5.3%

JSON

OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.

CPENameOperatorVersion
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service \(glance\)eq2013.2
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service \(glance\)eq2013.2.1

CPE	Name	Operator	Version
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service \(glance\)	eq	2013.2
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service \(glance\)	eq	2013.2.1