Vulnerability · Published Mar 23, 2022 · Assigned by redhat

CVE-2021-4180

Medium 4.3

In plain English

A medium-severity information exposure in openstack-tripleo-heat-templates. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.3Medium

Exploit odds (30 days)0.8%top 44.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the www_authenticate_uri parameter (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. This flaw affects openstack-tripleo-heat-templates versions prior to 11.6.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	tripleo-heat-templates	11.6.1	GHSA-hm3x-jwwf-jpr9
PyPI	tripleo-heat-templates	11.6.1	PYSEC-2026-753

Affected products (as reported)

Vendor	Product	Versions
n/a	openstack-tripleo-heat-templates	openstack-tripleo-heat-templates versions prior to 11.6.1

Weakness: CWE-200

References

https://bugzilla.redhat.com/show_bug.cgi?id=2035793 x_refsource_MISC