CVE-2014-5038

Eucalyptus 3.0.0 through 4.0.1, when the log level is set to DEBUG or lower, logs user and system passwords, which allows local users to obtain sensitive information by reading the cloud log files.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.eucalyptus.com/resources/security/advisories/esa-26	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:eucalyptus:eucalyptus:3.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.0.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.1.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.1.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.1.2:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.2.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.2.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.2.2:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.3.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.3.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.3.2:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.4.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.4.1:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.4.2:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:3.4.3:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:4.0.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:4.0.1:::::::*

History

No history.

Information

Published : 2014-11-07 19:55

Updated : 2014-11-10 13:37

NVD link : CVE-2014-5038

Mitre link : CVE-2014-5038

CVE.ORG link : CVE-2014-5038

JSON object : View

Products Affected

eucalyptus

eucalyptus

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2014-5038", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-11-07T19:55:03.793", "references": [{"url": "https://www.eucalyptus.com/resources/security/advisories/esa-26", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Eucalyptus 3.0.0 through 4.0.1, when the log level is set to DEBUG or lower, logs user and system passwords, which allows local users to obtain sensitive information by reading the cloud log files."}, {"lang": "es", "value": "Eucalyptus 3.0.0 hasta 4.0.1, cuando el nivel del registro est\u00e1 configurado en DEBUG o m\u00e1s bajo, registra las contrase\u00f1as de usuarios y sistemas, lo que permite a usuarios locales obtener informaci\u00f3n sensible mediante la lectura de los ficheros del registro de la nube."}], "lastModified": "2014-11-10T13:37:10.073", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB322B1B-8FE8-4CEF-A7F4-B86F131F9116"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2ECBDD1A-8E7A-48C0-B638-815DDC3A3A4B"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "043A9574-806B-429F-9878-AFEEC2334AF6"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "926B4E5D-804D-4E03-B5A6-17F127D99F96"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBC42BF2-045F-46FF-820B-C420B2A0029B"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FB5BCB7-CEE7-4A5A-8F55-02944F1FD1A4"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F3DDB7D-6A8F-4E0A-AA30-724FC9DAEA57"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4846C583-68DC-4F3A-B0A3-B130D776F0E6"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DFE3475-D8B5-4A24-A276-B46A2FF7DE95"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B9C730D-C4EB-436E-9C10-461F6B88AD1F"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA13D0DF-09E5-4BE2-8BFE-E2BA54F8B20B"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "824E50DE-8C83-4761-876D-C19FA25AC5E2"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "300B5D1C-419D-49A2-93BE-F4CC43D41407"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0E3EDA2-578C-458C-9C70-0E107AFB3509"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:3.4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75C8E8B6-0324-4622-A362-8F118E0FD682"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5215E04-773F-49E3-83C3-C00B65484674"}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:4.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3722B29B-DFAC-4C45-92DE-AA2825A47C4C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}