CVE-2018-16849 – mistral

Package

Manager: pip
Name: mistral
Vulnerable Version: >=0 <7.0.1

Severity

Level: High

CVSS v3.1: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00244 pctl0.47563

Details

openstack-mistral Discloses the presence of arbitrary files within the filesystem A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.

Metadata

Created: 2022-05-13T01:34:06Z
Modified: 2024-09-24T21:06:45Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fqw7-c6vr-q29m/GHSA-fqw7-c6vr-q29m.json
CWE IDs: ["CWE-200"]
Alternative ID: GHSA-fqw7-c6vr-q29m
Finding: F038
Auto approve: 1