CVE-2024-7319 Openstack-heat: incomplete fix for cve-2023-1625

2024-08-0220:36:24

CWE-200

redhat

www.cve.org

openstack

heat

incomplete fix

sensitive information disclosure

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

32.6%

JSON

An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 13 (Queens)",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openstack-heat",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/a:redhat:openstack:13"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 16.1",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openstack-heat",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openstack:16.1"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 16.2",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openstack-heat",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openstack:16.2"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 17.0",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openstack-heat",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openstack:17.0"
    ]
  }
]