Vulnerability Details : CVE-2015-7945
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results.
Vulnerability category: Information leak
Exploit prediction scoring system (EPSS) score for CVE-2015-7945
Probability of exploitation activity in the next 30 days: 0.48%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 73 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2015-7945
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2015-7945
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7945
-
http://www.ocert.org/advisories/ocert-2015-012.html
oCERT archivePatch;Third Party Advisory;VDB Entry
-
http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2
News — Ganeti 2.14.2 documentationRelease Notes;Vendor Advisory
-
https://www.exploit-db.com/exploits/39169/
Ganeti - Multiple Vulnerabilities
-
http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8
News — Ganeti 2.10.8 documentationRelease Notes;Vendor Advisory
-
http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7
News — Ganeti 2.9.7 documentationRelease Notes;Vendor Advisory
-
http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3
News — Ganeti 2.13.3 documentationRelease Notes;Vendor Advisory
-
http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2
News — Ganeti 2.15.2 documentationRelease Notes;Vendor Advisory
-
http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html
Ganeti Leaked Secret / Denial Of Service ≈ Packet StormPatch;Third Party Advisory;VDB Entry
-
http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8
News — Ganeti 2.11.8 documentationRelease Notes;Vendor Advisory
-
http://www.debian.org/security/2016/dsa-3431
Debian -- Security Information -- DSA-3431-1 ganeti
-
http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6
News — Ganeti 2.12.6 documentationRelease Notes;Vendor Advisory
Products affected by CVE-2015-7945
- cpe:2.3:a:spi-inc:ganeti:*:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.15.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.15.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.4:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.5:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.7:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.5:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.6:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.3:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.15.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.5:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.6:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.3:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.4:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.15.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.7:*:*:*:*:*:*:*