CVE-2013-4428

OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image… (CVE-2013-4428)

Description

OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly restrict access to cached images, which allows remote authenticated users to read otherwise restricted images via an image UUID.

Source: CVELISTV5 NVD

Metrics

Severity

none

52.10

—

no public PoC known

—

—

—

86.9 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

3.1 %

Moderate — model estimates 1-10% exploitation likelihood.

Published

2013-10-27 00:00 UTC

CWE

—

Affected operating systems

linux
canonical / ubuntu_linux12.10
linux
canonical / ubuntu_linux13.04

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

openstack
glance2012.2 – 2012.2.4
openstack
glance2013.1 – 2013.1.4
openstack
glance

References & sources

IDCVE-2013-4428