CVE-2013-6384 in OpenStack Ceilometerinfo

Summary

(1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information (the DB2 or MongoDB password) by reading the log file.

Reservation

11/04/2013

Disclosure

11/23/2013

Entries

VulDB provides additional information and datapoints for this CVE:

IDVulnerabilityCWEExpCouCVE
11301OpenStack Ceilometer Log Entry impl_mongodb.py information disclosure200Proof-of-ConceptOfficial fixCVE-2013-6384

Description

CPE

CWE

CVSS

Exploits

History

Diff

Relate

Threat Intelligence

API JSON

API XML

API CSV

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!