CVE-2015-5251

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

CVSS v2.0 5.5 MEDIUM

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:P

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2015-1897.html
https://bugs.launchpad.net/bugs/1482371
https://security.openstack.org/ossa/OSSA-2015-019.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\)::::::::
	cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2015.1.0:::::::*
	cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2015.1.1:::::::*

History

No history.

Information

Published : 2015-10-26 17:59

Updated : 2024-02-28 15:21

NVD link : CVE-2015-5251

Mitre link : CVE-2015-5251

CVE.ORG link : CVE-2015-5251

JSON object : View

Products Affected

openstack

image_registry_and_delivery_service_\(glance\)

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2015-5251", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-10-26T17:59:06.813", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2015-1897.html", "source": "secalert@redhat.com"}, {"url": "https://bugs.launchpad.net/bugs/1482371", "source": "secalert@redhat.com"}, {"url": "https://security.openstack.org/ossa/OSSA-2015-019.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*."}, {"lang": "es", "value": "OpenStack Image Service (Glance) en versiones anteriores a 2014.2.4 (juno) y 2015.1.x en versiones anteriores 2015.1.2 (kilo) permiten a usuarios remotos autenticados cambiar el estado de sus im\u00e1genes y eludir las restricciones de acceso a trav\u00e9s de la cabecera HTTP x-image-meta-status a images/*."}], "lastModified": "2023-02-13T00:52:30.893", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:image_registry_and_delivery_service_\\(glance\\):*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0964364D-BB85-4C6C-AC03-9C5654F31B11", "versionEndIncluding": "2014.2.3"}, {"criteria": "cpe:2.3:a:openstack:image_registry_and_delivery_service_\\(glance\\):2015.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C66E0C3C-F6B7-433D-9F93-531594C52D17"}, {"criteria": "cpe:2.3:a:openstack:image_registry_and_delivery_service_\\(glance\\):2015.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "897FC29D-7439-4BF2-8296-FB33712DCE43"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}