High severity · published Apr 15, 2016
CVE-2015-5271
The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the…
7.5
CVSS
2.4%
EPSS
No
On KEV
Description
The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive information from private containers via unspecified vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openstack · Redhat
7.0 · source: NVD
TH
Tripleo Heat Templates · Openstack
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5271
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5271
Vendor Advisory
https://access.redhat.com/errata/RHSA-2015:1862
bugs.launchpad.net
https://bugs.launchpad.net/tripleo/+bug/1494896
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1261697
launchpadlibrarian.net
https://launchpadlibrarian.net/217268516/CVE-2015-5271_puppet-swift.patch
More from Tripleo Heat Templates
8.8
CVE-2018-10898
A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40
7.5
CVE-2015-5303
The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by…
5.5
CVE-2021-3585
A flaw was found in openstack-tripleo-heat-templates
4.3
CVE-2021-4180
An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname