CVE-2011-4076

2019-11-2603:53:58

redhat

www.cve.org

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.4%

JSON

OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2_SECRET_KEY. An attacker could also presumably brute force values for EC2_ACCESS_KEY.

CNA Affected

[
  {
    "product": "nova",
    "vendor": "nova",
    "versions": [
      {
        "status": "affected",
        "version": "2014.1.3-11"
      }
    ]
  }
]