CVE-2014-3621

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Published: Oct 2, 2014
Updated: Apr 13, 2023
CVE: CVE-2014-3621
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 4
AV:N/AC:L/Au:S/C:P/I:N/A:N

CWEs:

CWE-200

Affected Software
References

Software	From	Fixed in
openstack / keystone	2014.1	2014.1.2.1
openstack / keystone	2013.2	2013.2.3
canonical / ubuntu_linux	14.04	14.04.x
redhat / openstack	5.0	5.0.x
redhat / openstack	4.0	4.0.x

http://rhn.redhat.com/errata/RHSA-2014-1688.html
http://rhn.redhat.com/errata/RHSA-2014-1789.html
http://rhn.redhat.com/errata/RHSA-2014-1790.html
http://www.openwall.com/lists/oss-security/2014/09/16/10
http://www.ubuntu.com/usn/USN-2406-1
https://bugs.launchpad.net/keystone/+bug/1354208

Vulnerability Database

CVE-2014-3621

Deep Security Visibility Without the Complexity