LiveActive security incident?Get immediate response
CVE Record

CVE-2015-3156: The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configurati...

The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2015-3156 affects OpenStack Trove DBaaS packages before 2015.1.0 Kilo. A local user could abuse unsafe temporary-file handling through symlinks to make Trove write configuration content where it should not. Business urgency depends on whether old Trove guest agents or images remain in use.

Executive priority

Treat as a legacy platform hygiene issue with meaningful risk in older OpenStack DBaaS estates. Prioritize if Trove remains deployed, guestagent images are reused, or untrusted local users can access database service instances.

Technical view

Multiple Trove guestagent datastore and backup/restore routines wrote configuration or command files through temporary paths vulnerable to symlink attacks. The issue spans MySQL, MongoDB, PostgreSQL, Redis, Cassandra, and Couchbase-related code paths in OpenStack Trove before 2015.1.0.

Likely exposure

Exposure is most likely in legacy OpenStack environments running Trove DBaaS or old guestagent images based on pre-Kilo packages. The source data does not identify current supported products or downstream fixed package versions.

Exploitation context

The CVE describes local-user exploitation. It is not listed in KEV, and the supplied sources do not show active exploitation. Impact may be serious where a local tenant, service user, or compromised process can influence Trove guestagent temporary files.

Researcher notes

The source bundle provides affected code areas and the local symlink-write condition, but no CVSS, CWE, exploit evidence, or detailed downstream package matrix. Avoid broad claims beyond OpenStack Trove before 2015.1.0 unless validated against vendor advisories.

Mitigation direction

  • Inventory Trove deployments, guestagent images, and packages for versions older than 2015.1.0 Kilo.
  • Check OpenStack and distribution vendor guidance for fixed Trove packages or backports.
  • Retire or rebuild obsolete Trove guestagent images from fixed package sources.
  • Restrict local shell and service-user access on Trove guest instances.
  • Monitor protected datastore configuration files for unexpected ownership, symlinks, or content changes.

Validation and detection

  • Confirm whether OpenStack Trove is deployed or present in historical DBaaS images.
  • Compare installed Trove package versions against pre-2015.1.0 Kilo exposure.
  • Review guestagent filesystem permissions around temporary directories and datastore configuration paths.
  • Check vendor changelogs or advisories for the applied CVE-2015-3156 fix.
  • Look for unexpected configuration-file changes around Trove backup, restore, or guestagent operations.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2015-3156 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
10Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.