OpenStack Murano 16.0.0 YaQL 'MuranoPL' Env Sanitization Flaw
CVE-2024-29156 Published on March 18, 2024
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
Vulnerability Analysis
CVE-2024-29156 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is an Output Sanitization Vulnerability?
The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVE-2024-29156 has been classified to as an Output Sanitization vulnerability or weakness.
Products Associated with CVE-2024-29156
stack.watch emails you whenever new vulnerabilities are published in OpenStack Yaql or OpenStack Murano. Just hit a watch button to start following.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.