Every CVE Search/ Get API key

CVE-2014-3621

OpenStack Identity Keystone Exposure of Sensitive Information

4.0 MediumFix available

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Exploit likelihood

2.13%Up 0.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.0

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Record
CVE-2014-3621
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Record
CVE-2014-3621
Updated
2026-11-02
EUVDEUVD-2022-3236 No score

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Record
EUVD-2022-3236
Updated
2026-11-03
GitHub AdvisoriesGHSA-8v8f-vc72-pmhc No score

OpenStack Identity Keystone Exposure of Sensitive Information

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Record
GHSA-8v8f-vc72-pmhc
Weakness
CWE-200
Updated
2026-11-02
OSV No score

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Record
CVE-2014-3621
Updated
2026-11-02
OSVDEBIAN-CVE-2014-3621 No score

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Record
DEBIAN-CVE-2014-3621
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-8v8f-vc72-pmhc No score

OpenStack Identity Keystone Exposure of Sensitive Information

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Record
GHSA-8v8f-vc72-pmhc
Weakness
CWE-200
Updated
2026-11-02
OSVPYSEC-2026-653 No score

OpenStack Identity Keystone Exposure of Sensitive Information

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Record
PYSEC-2026-653
Updated
2026-11-02
OSVUBUNTU-CVE-2014-3621 No score

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Record
UBUNTU-CVE-2014-3621
Updated
2026-11-02
OSVUSN-2406-1 No score

keystone vulnerability

Brant Knudson discovered that OpenStack Keystone did not properly perform input sanitization when performing endpoint catalog substitution. A remote attacker with privileged access for creating endpoints could exploit this to obtain sensitive information.

Record
USN-2406-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
keystone
PyPI
 before 8.0.0a0
8.0.0a0
keystone
Debian:12
 before 2014.1.3-1
2014.1.3-1
keystone
Debian:13
 before 2014.1.3-1
2014.1.3-1
keystone
Debian:14
 before 2014.1.3-1
2014.1.3-1
openstack-keystone
Red Hat:openstack:4::el6
From an advisory covering 2 CVEs
 before 0:2013.2.4-1.el6ost
0:2013.2.4-1.el6ost
openstack-keystone-doc
Red Hat:openstack:4::el6
From an advisory covering 2 CVEs
 before 0:2013.2.4-1.el6ost
0:2013.2.4-1.el6ost
python-keystone
Red Hat:openstack:4::el6
From an advisory covering 2 CVEs
 before 0:2013.2.4-1.el6ost
0:2013.2.4-1.el6ost
openstack-keystone
Red Hat:openstack:5::el6
 before 0:2014.1.3-2.el6ost
0:2014.1.3-2.el6ost
openstack-keystone-doc
Red Hat:openstack:5::el6
 before 0:2014.1.3-2.el6ost
0:2014.1.3-2.el6ost
python-keystone
Red Hat:openstack:5::el6
 before 0:2014.1.3-2.el6ost
0:2014.1.3-2.el6ost
Show 4 moreShow less
Affected packages
PackageAffectedFixed
openstack-keystone
Red Hat:openstack:5::el7
 before 0:2014.1.3-2.el7ost
0:2014.1.3-2.el7ost
openstack-keystone-doc
Red Hat:openstack:5::el7
 before 0:2014.1.3-2.el7ost
0:2014.1.3-2.el7ost
python-keystone
Red Hat:openstack:5::el7
 before 0:2014.1.3-2.el7ost
0:2014.1.3-2.el7ost
keystone
Ubuntu:14.04:LTS
 before 1:2014.1.3-0ubuntu2.1, plus listed versions
1:2013.2~rc4-0ubuntu11:2013.2-0ubuntu11:2013.2-0ubuntu1.11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu1
Show 9 moreShow less
1:2014.1~b3-0ubuntu21:2014.1~b3-0ubuntu31:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu11:2014.1.2.1-0ubuntu11:2014.1.2.1-0ubuntu1.11:2014.1.3-0ubuntu2
1:2014.1.3-0ubuntu2.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-3621 is a medium vulnerability (CVSS 4.0) in Openstack Keystone, published October 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. Fixed in keystone 8.0.0a0.

References

Show 34 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open