{"id":"CVE-2024-4840","aliases":["EUVD-2024-44553","GHSA-m73w-f4gh-h9g2","RHSA-2024:9978"],"status":"published","title":"Rhosp-director: cleartext passwords exposed in logs","description":"An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00196,"percentile":0.09415,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-312"],"published":"2024-05-13T22:16:39Z","modified":"2026-06-17T08:03:01Z","fixes":[{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-tripleo-heat-templates","fixed_in":["0:14.3.1-17.1.20240919130756.el9ost"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-tripleo-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.3.1-17.1.20240919130756.el9ost"}]}]}],"products":[{"vendor":"red hat","product":"red hat openstack platform 16.2"},{"vendor":"red hat","product":"red hat openstack platform 17.1 for rhel 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:9978","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4840","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2280249","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4840","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m73w-f4gh-h9g2"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235206","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242069","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243267","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249881","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252442","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264238","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274355","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2275307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276592","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2284645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2290685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2293048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2293735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295402","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2303551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2304312","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2305981","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2306489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2307256","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2307307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2310427","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2311465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2313372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2313502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2314658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2316083","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2320400","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9978.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4840","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-4840","title":"Rhosp-director: cleartext passwords exposed in logs","description":"An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.","status":"published","published":"2024-05-13T22:16:39.899Z","modified":"2025-11-20T19:15:50.057Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:34:17.150655Z"}],"euvd":[{"id":"EUVD-2024-44553","description":"An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.","status":"published","published":"2024-05-13T22:16:39Z","modified":"2025-11-20T19:15:50Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:14.058235Z"}],"ghsa":[{"id":"GHSA-m73w-f4gh-h9g2","title":"An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and...","description":"An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.","status":"published","published":"2024-05-14T18:30:58Z","modified":"2024-11-25T06:34:57Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:58:56.443174Z"}],"nvd":[{"id":"CVE-2024-4840","description":"An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.","status":"published","published":"2024-05-14T15:45:17.31Z","modified":"2026-06-17T08:03:01.517Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:09:58.124007Z"}],"osv":[{"id":"RHSA-2024:9978","title":"Red Hat Security Advisory: RHOSP 17.1.4 (openstack-tripleo-heat-templates) security update","status":"published","published":"2024-11-25T09:53:21Z","modified":"2025-11-22T13:31:06Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"}]}}