Information Disclosure

2023-04-2801:53:27

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

openstack-heat

information disclosure

vulnerability

get_environment

service.py

sensitive data

encrypt_parameters_and_properties

EPSS

0.001

Percentile

32.6%

JSON

openstack-heat is vulnerable to Information Disclosure. The vulnerability exists because the get_environment function of service.py does not mask hidden parameter values, which allows an attacker to get sensitive data through the get stack environment API even when the encrypt_parameters_and_properties option is set to true