CVE-2024-4840
Rhosp-director: cleartext passwords exposed in logs
An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Rhosp-director: cleartext passwords exposed in logs
An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.
- Record
CVE-2024-4840- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
EUVDEUVD-2024-44553
An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.
- Record
EUVD-2024-44553- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m73w-f4gh-h9g2
An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and...
An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.
- Record
GHSA-m73w-f4gh-h9g2- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
NVD
An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.
- Record
CVE-2024-4840- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
OSVRHSA-2024:9978
Red Hat Security Advisory: RHOSP 17.1.4 (openstack-tripleo-heat-templates) security update
- Record
RHSA-2024:9978- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openstack-tripleo-heat-templatesRed Hat:openstack:17.1::el9 |
before 0:14.3.1-17.1.20240919130756.el9ost | 0:14.3.1-17.1.20240919130756.el9ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-4840 is a medium vulnerability (CVSS 5.5) in Red Hat Openstack Platform 16.2, published May 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in openstack-tripleo-heat-templates 0:14.3.1-17.1.20240919130756.el9ost.
References
access.redhat.com/errata/RHSA-2024:9978
bugzilla.redhat.com/show_bug.cgi?id=2280249
nvd.nist.gov/vuln/detail/CVE-2024-4840
github.com/advisories/GHSA-m73w-f4gh-h9g2
Show 40 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9978.json
cve.org/CVERecord?id=CVE-2024-4840