CVE-2024-4840

Rhosp-director: cleartext passwords exposed in logs

State: Published
Severity: 5.5 Medium
Published: May 13, 2024
Updated: Nov 20, 2025
Reserved: May 13, 2024

Description

An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	redhat

Weaknesses

CWE-312 Cleartext Storage of Sensitive Information

Affected Products

Product	Versions
openstack-tripleo-heat-templates	14.3.1-17.1.20240528170747.e7c7ce3.el9ostNot affected
Red Hat OpenStack Platform 17.1 for RHEL 9Red Hat	0:14.3.1-17.1.20240919130756.el9ost and laterNot affected
Red Hat OpenStack Platform 16.2Red Hat

References

RHSA-2024:9978vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-4840vdb-entry
RHBZ#2280249issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.