CVE-2015-5223
openstack-swift: Information leak via Swift tempurls
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.
OpenStack Object Storage (Swift) en versiones anteriores a 2.4.0 permite a atacantes obtener información sensible a través de un PUT tempurl y un manifiesto de objeto DLO que hace referencia a un objeto en otro contenedor.
A flaw was discovered in the OpenStack Object Storage service (swift) TempURLs. An attacker in possession of a TempURL key with PUT permissions could gain read access to other objects in the same project (tenant).
OpenStack Object Storage provides object storage in virtual containers, which allows users to store and retrieve files. The service's distributed architecture supports horizontal scaling; redundancy as failure-proofing is provided through software-based data replication. Because Object Storage supports asynchronous eventual consistency replication, it is well suited to deployment in multiple data centers. A flaw was found in the OpenStack Object storage service tempurls. An attacker in possession of a tempurl key with PUT permissions may be able to gain read access to other objects in the same project.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-07-01 CVE Reserved
- 2015-10-16 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2015/08/26/5 | Mailing List |
|
| http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html | X_refsource_confirm |
|
| http://www.securityfocus.com/bid/84827 | Vdb Entry | |
| https://bugs.launchpad.net/swift/+bug/1449212 | X_refsource_confirm | |
| https://bugs.launchpad.net/swift/+bug/1453948 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00025.html | 2018-01-05 | |
| http://rhn.redhat.com/errata/RHSA-2015-1895.html | 2018-01-05 | |
| http://rhn.redhat.com/errata/RHSA-2016-0329.html | 2018-01-05 | |
| https://security.openstack.org/ossa/OSSA-2015-016.html | 2018-01-05 | |
| https://access.redhat.com/security/cve/CVE-2015-5223 | 2016-03-01 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1255622 | 2016-03-01 |