Unscored severity · published Oct 8, 2014
CVE-2014-7231
The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when…
–
CVSS
0.5%
EPSS
No
On KEV
Description
The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Cinder · Openstack
2013.2 before 2013.2.4; 2014.1 before 2014.1.3 · source: NVD
NO
Nova · Openstack
2013.2 before 2013.2.4; 2014.1 before 2014.1.3 · source: NVD
OP
Openstack · Redhat
5.0 · source: NVD
TR
Trove · Openstack
2013.2 before 2013.2.4; 2014.1 before 2014.1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7231
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7231
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1939.html
Mailing List
http://seclists.org/oss-sec/2014/q3/853
Third Party Advisory
http://www.securityfocus.com/bid/70184
Exploit
https://bugs.launchpad.net/oslo.utils/+bug/1345233
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/96726
More from Cinder
7.5
CVE-2017-15139
A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data
7.5
CVE-2015-5162
The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls,…
6.5
CVE-2024-32498
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3
5.7
CVE-2022-47951
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x…
4.3
CVE-2026-93856
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API