Intel

CVE-2013-0335

OpenStack Compute Nova Unauthorised access to arbitrary VM using VNC token from deleted VM

highEPSS 2.1%

Description

OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.

Source: OSVCVELISTV5NVDOSV

Metrics

Severity
high
Priority score
87.48
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
7.6
Source: nvd-v3
CVSS v3
7.6
CVSS v4
—
EPSS percentile
80.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
2.1 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2022-05-05 02:48 UTC
CWE
CWE-613

Weakness classes (CWE)

  • CWE-613Base

    Insufficient Session Expiration

    According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-07-31 15:16 UTC· secalert@redhat.com
    • CVSS V3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
    • CWE: CWE-613
    • Reference: https://access.redhat.com/errata/RHSA-2013:0709
    • Reference: https://access.redhat.com/security/cve/CVE-2013-0335

Affected operating systems

  • linux

    canonical / ubuntu_linux11.10

  • linux

    canonical / ubuntu_linux12.04

  • linux

    canonical / ubuntu_linux12.10

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • openstack

    essex

  • openstack

    folsom

  • openstack

    grizzly

References & sources

IDCVE-2013-0335