Configuration Option Leak in OpenStack Identity Keystone

CVE-2014-3621

Summary

The vulnerability in OpenStack Identity (Keystone) allows authenticated remote users to access sensitive configuration options by manipulating the endpoint. This is achieved through a crafted request that exploits the catalog URL replacement feature, exposing potentially critical data like the 'admin_token' via the public URL endpoint field. This flaw underscores the importance of secure configurations and appropriate access controls in identity management systems.

References