CVE-2014-7231

LowCVSS 2.1/10Last modified Jun 17, 2026

Description

The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.

Metrics

CVSS 2.0 2.1/10AV:L/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2014-1939.htmlThird Party Advisory
http://seclists.org/oss-sec/2014/q3/853Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/70184Third Party Advisory, VDB Entry
https://bugs.launchpad.net/oslo.utils/+bug/1345233Exploit, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/96726Third Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2014-1939.htmlThird Party Advisory
http://seclists.org/oss-sec/2014/q3/853Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/70184Third Party Advisory, VDB Entry
https://bugs.launchpad.net/oslo.utils/+bug/1345233Exploit, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/96726Third Party Advisory, VDB Entry

Timeline

Published: Oct 8, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-723210.0GE Healthcare Discovery XR656 and XR656 G2 has a password of (1) 2getin for the insite user, (2) 4$xray for the xruser user, and (3) #superx CVE-2014-723310.0GE Healthcare Precision THUNIS-800+ has a default password of (1) 1973 for the factory default System Utilities menu, (2) TH8740 for install CVE-2014-723510.0htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 bef CVE-2014-72369.1Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the de CVE-2014-72376.8lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restrictions and CVE-2014-72386.1The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS CVE-2014-72406.1Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject CVE-2014-72416.8The TSUTAYA application 5.3 and earlier for Android allows remote attackers to execute arbitrary Java methods via a crafted HTML document.CVE-2014-72425.9The SumaHo application 3.0.0 and earlier for Android and the SumaHo "driving capability" diagnosis result transmission application 1.2.2 and CVE-2014-72435.0LG Electronics Mobile WiFi router L-09C, L-03E, and L-04D does not restrict access to the web administration interface, which allows remote CVE-2014-72463.5The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a multi-ser CVE-2014-724710.0Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro