In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 17.0.0, < 29.0.6CPE match | cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:* | ||
>= 30.0.0, < 32.0.2CPE match | cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:* | ||
>= 33.0.0, < 35.0.2CPE match | cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:* | ||
>= 36.0.0, < 37.0.1CPE match | cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.