CVE-2013-4471

The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2014-05-14 19:55

Updated : 2024-02-28 12:20


NVD link : CVE-2013-4471

Mitre link : CVE-2013-4471

CVE.ORG link : CVE-2013-4471


JSON object : View

Products Affected

openstack

  • horizon
CWE
CWE-287

Improper Authentication