CVE-2018-16856

2019-03-2617:45:29

CWE-532

redhat

www.cve.org

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

53.8%

JSON

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

CNA Affected

[
  {
    "product": "openstack-octavia",
    "vendor": "[UNKNOWN]",
    "versions": [
      {
        "status": "affected",
        "version": "2.0.2-5"
      },
      {
        "status": "affected",
        "version": "openstack-octavia-3.0.1-0.20181009115732"
      }
    ]
  }
]