Unscored severity · published Nov 23, 2013
CVE-2013-6384
(1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which…
–
CVSS
0.4%
EPSS
No
On KEV
Description
(1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information (the DB2 or MongoDB password) by reading the log file.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Ceilometer · Openstack
2013.1 through 2013.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6384
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6384
Mailing List
http://www.openwall.com/lists/oss-security/2013/11/22/3
Mailing List
http://www.openwall.com/lists/oss-security/2013/11/25/3
Exploit
https://bugs.launchpad.net/ceilometer/+bug/1244476
More from Ceilometer
7.8
CVE-2019-3830
A vulnerability was found in ceilometer before version 12.0.0.0rc1