CVE-2018-16849CWE-200

A flaw was found in openstack-mistral

Low · published November 2, 2018

CVSS v3.0
3.1
EPSS
2%
Percentile
74.4
In the wild
Unconfirmed
What it is

A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.

The record
Technical detail
CVSS v3.0
3.1 · LOW
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01520 · 74.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2018-11-02T21:00Z
EPSS history
Timeline
  • 02 NOV 21:00Z
    A flaw was found in openstack-mistral
    cvelistv5