CVE-2021-3585

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployment with subscription-manager.

Se ha encontrado un fallo en openstack-tripleo-heat-templates. Las contraseñas simples de RHSM se presentan en los registros durante el despliegue de OSP13 con subscription-manager.

*Credits: N/A

CVSS Scores

NISTv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-06-07 CVE Reserved
2022-08-26 CVE Published
2024-08-03 CVE Updated
2024-08-03 First Exploit
2024-11-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-312: Cleartext Storage of Sensitive Information

CAPEC

References (4)

URL	Tag	Source
https://access.redhat.com/security/cve/CVE-2021-3585	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1968247	Issue Tracking

URL	Date	SRC
https://bugs.launchpad.net/tripleo/+bug/1931132	2024-08-03

URL	Date	SRC
https://review.opendev.org/c/openstack/tripleo-heat-templates/+/791988	2022-09-01

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Openstack Search vendor "Openstack"		Tripleo Heat Templates Search vendor "Openstack" for product "Tripleo Heat Templates"				< 8.4.1 Search vendor "Openstack" for product "Tripleo Heat Templates" and version " < 8.4.1"		-		Affected