CVE-2015-7713

OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.

Published: 2015-10-29 Last update: 2026-05-06 Assigner: [email protected] Source: [email protected]

NVD Status：Modified，CVE State: published

View at NVD, CVE.org, EUVD

Threat Intelligence & Risk Assessment for CVE-2015-7713

EPSS CVSS CWE GHSA Affected OS Tracker

Conclusion & alert: CVE-2015-7713 is rated Moderate Risk (53/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 3.67%). Core evidence: EPSS rose +2.15% over the last day, indicating growing attacker interest. Mandatory action: Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2015-7713

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	1.52%	3.67%	+2.15%
2	2025-06-26	0.81%	1.52%	+0.71%
3	2025-03-30	—	0.81%	—

Full EPSS history (9 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2015-7713

CVSS metrics for this CVE.

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.0	2.0	MEDIUM	`AV:N/AC:L/Au:N/C:N/I:P/A:N` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:N) No confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:N) No availability impact.	10.0	2.9	[email protected]

Weakness enumeration for CVE-2015-7713

CWE-254 MITRE ↗

GitHub Security Advisory for CVE-2015-7713

GHSA-67rh-9p29-vrxr · Severity: medium · Ecosystem: pip — OpenStack Compute (Nova) allows remote attackers to bypass intended restriction

OS Trackers for CVE-2015-7713

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2015-7713 not yet assigned priority: Debian including 1 source packages (nova), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2015-7713
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2015-7713
`ubuntu`	medium	CVE-2015-7713 medium priority: Ubuntu including 1 source packages (nova), 8 status rows across 8 suites (precise, trusty, upstream, vivid, wily, xenial, yakkety, zesty): not-affected 5, ignored 1, needs-triage 1, released 1.	https://ubuntu.com/security/CVE-2015-7713

Affected software / configurations for CVE-2015-7713

Vendor	Product	Version	Raw CPE
openstack	nova	>= 2014.2, < 2014.2.4	cpe:2.3:a:openstack:nova::::::::
openstack	nova	>= 2015.1.0, < 2015.1.2	cpe:2.3:a:openstack:nova::::::::

References for CVE-2015-7713

URL	Tags
http://rhn.redhat.com/errata/RHSA-2015-2684.html	Third Party Advisory
http://www.securityfocus.com/bid/76960	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2015:2673	Third Party Advisory
https://bugs.launchpad.net/nova/+bug/1491307	Third Party Advisory
https://bugs.launchpad.net/nova/+bug/1492961	Third Party Advisory
https://security.openstack.org/ossa/OSSA-2015-021.html	Vendor Advisory

cvelogic Threat Intelligence