5.9

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2015-8749

CVE-2015-8749: OpenStack Nova Potential Xen connection password leak via StorageError

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2015-8749

CVE-2015-8749:

5.9

CVSS Score

3.0

-

CVSS Score

Basic Information

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nova	pip	>= 12.0.0, < 12.0.1	12.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from two key functions:

_parse_volume_info in volume_utils.py raised StorageError with unmasked connection_data, which included auth_password. The patch explicitly adds strutils.mask_password to sanitize this data.
_connect_hypervisor_to_volume in volumeops.py logged connection_data without masking. The patch adds strutils.mask_password to the LOG.debug call. Both functions directly handled sensitive data without proper obfuscation in vulnerable versions, as confirmed by the commit diff and test cases validating the absence of credentials in error/log outputs.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

5.9

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2015-8749: OpenStack Nova Potential Xen connection password leak via StorageError

CVE-2015-8749:

5.9

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Detect and Respond To Threats Faster.

5.9

5.9

Basic Information

Basic Information

Technical Details

CVE-2015-8749: OpenStack Nova Potential Xen connection password leak via StorageError

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

5.9

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2015-8749: OpenStack Nova Potential Xen connection password leak via StorageError

CVE-2015-8749:

5.9

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

5.9

5.9

Basic Information

Basic Information

Technical Details

CVE-2015-8749: OpenStack Nova Potential Xen connection password leak via StorageError

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI