Cyber Resilience

CVE-2023-1625

Redhat Openstack Platform 13.0 … 17.0

Public PoC
Published
24 September 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
EPSS Score 0.0071 50th percentile
Risk Priority 54 floored blend · peak EPSS

Summary

CVE-2023-1625 is a high-severity Exposure of Sensitive Information Through Data Queries (CWE-202) vulnerability in Redhat Openstack Platform. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Information Repositories (T1213); ranked in the top 50% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity,…

more

and availability of the system.

CWE(s)
CWE-202NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1213 Data from Information Repositories Collection
Adversaries may leverage information repositories to mine valuable information.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-7319Same product: Openstack Heat
CVE-2023-1633Same product: Redhat Openstack Platform
CVE-2023-1636Same product: Redhat Openstack Platform
CVE-2025-29981Shared CWE-202
CVE-2023-20215Shared CWE-202
CVE-2024-38897Shared CWE-202
CVE-2023-0785Shared CWE-202
CVE-2026-30778Shared CWE-202
CVE-2025-64528Shared CWE-202
CVE-2024-2088Shared CWE-202

Affected Assets

openstack
heat
all versions
redhat
openstack platform
13.0, 16.1, 16.2, 17.0

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Least-privilege query permissions directly limit the data an attacker can request or infer.

DE.CM-03 partial match
prevents

Behavior analytics on query activity can detect inference attempts but does not prevent exposure at query time.

PR.DS-10 partial match
prevents

Protecting data-in-use reduces what remains available for inference via queries.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.15 Access control mostly match
prevents

Access control limits who can run queries that could expose sensitive information via inference.

A.5.18 Access rights mostly match
prevents

Granular access rights reduce the ability of users to craft inference queries.

A.8.11 Data masking mostly match
prevents

Data masking prevents inference by obscuring sensitive values returned in query results.

A.8.3 Information access restriction mostly match
prevents

Information access restriction directly limits query scope that could lead to inference.

A.5.12 Classification of information partial match
mitigates

Classification helps identify sensitive data that must be protected from inference attacks.

A.8.12 Data leakage prevention partial match
finds

DLP can detect and block queries or result sets that risk exposing sensitive information.

References