CVE-2014-3621
No CVSS score yet. EPSS 2.1% chance of exploitation in the next 30 days. Fixed in keystone 8.0.0a0.
The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- openstack:keystone
- redhat:openstack
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8v8f-vc72-pmhc | PyPI | keystone | <8.0.0a0 | 8.0.0a0 |
| PYSEC-2026-653 | PyPI | keystone | <8.0.0a0 | 8.0.0a0 |