9.8

CVE-2016-7404

EPSS 2.86%
Published 21.06.2019 14:15:10
Last modified 21.11.2024 02:57:55
Source cve@mitre.org
Teams watchlist Login
Open Login

OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.

Affected products Warnungen 0 Metrics 3 CWE 1 References 7

Data is provided by the National Vulnerability Database (NVD)

Openstack ≫ Magnum Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	2.86%	0.85

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://bugs.launchpad.net/magnum/+bug/1620536

Third Party Advisory

Broken Link

Issue Tracking

https://bugzilla.suse.com/show_bug.cgi?id=998182

Patch

Third Party Advisory

Issue Tracking

https://opendev.org/openstack/magnum/commit/0bb0d6486d6771ee21bbf897a091b1aa59e01b22

Patch

Third Party Advisory

https://www.securityfocus.com/bid/98467

Third Party Advisory

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2016-7404

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-7404

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-7404

EUVD