CVE-2024-1141
Openstack Glance-Store ≤ 4.7.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-1141 is a medium-severity Logging of Excessive Data (CWE-779) vulnerability in Openstack Glance-Store. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique LSASS Memory (T1003.001); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AU-2 (Event Logging) and AU-7 (Audit Record Reduction and Report Generation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0752
Vulnerability Data
A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enabled.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Defining the exact event types to be logged prevents indiscriminate collection of excessive data.
Audit-record reduction and on-demand reporting directly reduce the impact of overly verbose logs during review.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Excessive logging hinders log processing and forensic analysis, largely undermining DE.AE-04's ability to estimate impact/scope via SIEMs or tools while removing most of that outcome's efficacy.
Excessive logging undermines event analysis by flooding logs with noise that hinders processing and forensic review, but does not blind or defeat the outcome the way insufficient logging would.
Excessive logging impairs processing of provided event data and log-analysis findings (one aspect of DE.AE-06) without fully defeating alert/ticket distribution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
documenting procedures for log management (including references to 8.15/8.17) is a governance dependency that other controls may act on; it does not itself stop excessive data from being logged or hinder exploitation of that weakness
A.8.15 directly requires logging to be configured so that only necessary events are recorded, preventing excessive data.
A.8.16 detects and alerts on anomalous behaviour and events (including via logs), but does not stop excessive logging from occurring or being exploitable in the first place; the weakness of logging too much data remains present.