CVE-2015-9543

Katalog CVE

CVSS 3.3 · Low EPSS 0,41%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada openstack nova. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is related to NovaProxyRequestHandlerBase.new_websocket_client in console/websocketproxy.py.

Rincian

Terbit di NVD

19 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.openstack.org/ossa/OSSA-2020-001.html patch · advisory vendor
• http://www.openwall.com/lists/oss-security/2020/02/19/2 mailing list · patch · advisory pihak ketiga
• https://launchpad.net/bugs/1492140 issue tracking · advisory pihak ketiga
• https://review.opendev.org/220622 advisory pihak ketiga