CVE-2015-7514

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/12/03/4Mailing List, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1285809Issue Tracking, Patch, Third Party Advisory, VDB Entry
https://review.openstack.org/#/c/252993Issue Tracking, Patch, Vendor Advisory
https://review.openstack.org/#/c/253001Issue Tracking, Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2015/12/03/4Mailing List, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1285809Issue Tracking, Patch, Third Party Advisory, VDB Entry
https://review.openstack.org/#/c/252993Issue Tracking, Patch, Vendor Advisory
https://review.openstack.org/#/c/253001Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Jun 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-75154.6The aiptek_probe function in drivers/input/tablet/aiptek.c in the Linux kernel before 4.4 allows physically proximate attackers to cause a d CVE-2015-75167.5ONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of service (NULL pointer dereference and switch disconne CVE-2015-75179.8Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute CVE-2015-75184.3Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrar CVE-2015-75193.7agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in CVE-2015-75206.1Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x befo CVE-2015-75218.3The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthor CVE-2015-75277.5lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters i CVE-2015-75285.3Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.CVE-2015-75297.8sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an a CVE-2015-75365.4Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrar CVE-2015-75378.8Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authent