CVE-2015-5303

High

Published: 11/04/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The TripleO Heat templates (tripleo-heat-templates) allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.

Risk Assessment

This vulnerability may lead to unauthorized access to network metadata, jeopardizing the integrity and confidentiality of data within the OpenStack infrastructure.

Recommendation

It is recommended to change the default value of the NeutronMetadataProxySharedSecret parameter and to monitor metadata requests for potential attack attempts.

Other vulnerabilities in tripleo-heat-templates

CVE-2015-5329High
The TripleO Heat templates in Red Hat Enterprise Linux OpenStack Platform 7.0 do not properly use the configured RabbitMQ credentials, making it easier for remote attackers to gain access to services in deployed overclouds by leveraging knowledge of the default credentials.

Original NVD description (English source)

The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.