CVE-2014-3801

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-05-23 · updated 2026-06-17
Weakness: CWE-200

Description

OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL via the resource-type-list.

Affected products

OpenStack Heat: 2013.2, 2013.2.1, 2013.2.2, 2013.2.3, 2014.1

References

http://rhn.redhat.com/errata/RHSA-2014-1687.html
http://www.openwall.com/lists/oss-security/2014/05/20/1
http://www.openwall.com/lists/oss-security/2014/05/20/6
http://www.securityfocus.com/bid/67505
http://www.ubuntu.com/usn/USN-2249-1
https://bugs.launchpad.net/heat/+bug/1311223
http://rhn.redhat.com/errata/RHSA-2014-1687.html
http://www.openwall.com/lists/oss-security/2014/05/20/1
http://www.openwall.com/lists/oss-security/2014/05/20/6
http://www.securityfocus.com/bid/67505
http://www.ubuntu.com/usn/USN-2249-1
https://bugs.launchpad.net/heat/+bug/1311223

Get alerted when CVE-2014-3801 or the next vulnerability affects your stack