CVE-2024-29156 in Murano

Riassunto

di MITRE • 18/03/2024

In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Prenotare: 18/03/2024
• Divulgazione: 18/03/2024
• Moderazione: accettato
• Voce: VDB-257111
• CPE: pronto
• CWE: CWE-200 (confermato)
• CVSS: 6.5 (NVD)
• EPSS: 0.00740
• KEV: no
• Attività: molto basso
• Settore: Pharma, Telecommunication, ...

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2024-29156
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-29156
• CVE Details: https://www.cvedetails.com/cve/CVE-2024-29156/