CVE-2016-9590 MEDIUM

CVE-2016-9590

Vendor Unspecified
Product puppet-swift
Weakness CWE-200 · Info exposure
Published April 26, 2018
Last update August 6, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage (swift). During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf file with world-readable permissions.

Key dates

02Disclosure timeline

April 26, 2018 CVE published
August 6, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-13494 SSP Debug <= 1.0.0 - Unauthenticated Sensitive Information Exposure CVE-2025-12492 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure CVE-2022-29901 Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed) CVE-2026-2207 WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure CVE-2022-31043 Fix failure to strip Authorization header on HTTP downgrade in Guzzle