OpenStack Compute (Nova) allows remote authenticated users to obtain sensitive information

CVE-2013-2256 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

Basic information

Type: reviewed
Severity: medium
Advisory on GitHub: Open advisory ↗
Repository advisory: —
Source code: Browse source ↗
Published (advisory): 2022-05-14 01:58:46 UTC
Updated: 2023-02-08 17:53:51 UTC
GitHub reviewed: 2023-02-08 17:53:50 UTC
NVD published: 2013-09-16

EPSS Score

Score	Percentile
0.47%	64.53%

CVSS Scores

No CVSS scores in this advisory.

Identifiers

Type	Value
GHSA	GHSA-5mj6-643f-2g85 ↗
CVE	CVE-2013-2256 ↗

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
pip	nova	< 2013.1.3	2013.1.3	—

References

cvelogic Threat Intelligence