CVE-2015-5306

OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.

Published Bysecalert@redhat.com

Published DateNov 25, 2015, 20:59

Affected Versions(2)

python-ironic-inspector-client(PyPI)

Introduced0

Fixed0.2.5

LimitN/A

ironic-inspector(PyPI)

Introduced0

Fixed2.2.2

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
python-ironic-inspector-client(PyPI)	0	0.2.5	N/A
ironic-inspector(PyPI)	0	2.2.2	N/A

Weakness Type (CWE):CWE-254

CVSS Metrics

Base Score

6.8

Vector String

AV:N/AC:M/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

Weakness Type (CWE):CWE-254

CVSS Metrics

Base Score

6.8

Vector String

AV:N/AC:M/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL