CVE-2016-0757

OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2016-0309.html
http://www.securityfocus.com/bid/82696
https://security.openstack.org/ossa/OSSA-2016-006.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):11.0.0:::::::*
	cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):11.0.1:::::::*
	cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2015.1.2:::::::*

History

No history.

Information

Published : 2016-04-13 17:59

Updated : 2024-02-28 15:21

NVD link : CVE-2016-0757

Mitre link : CVE-2016-0757

CVE.ORG link : CVE-2016-0757

JSON object : View

Products Affected

openstack

image_registry_and_delivery_service_\(glance\)

CWE

CWE-284

Improper Access Control

{"id": "CVE-2016-0757", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2016-04-13T17:59:09.867", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2016-0309.html", "source": "secalert@redhat.com"}, {"url": "http://www.securityfocus.com/bid/82696", "source": "secalert@redhat.com"}, {"url": "https://security.openstack.org/ossa/OSSA-2016-006.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image."}, {"lang": "es", "value": "OpenStack Image Service (Glance) en versiones anteriores a 2015.1.3 (kilo) y 11.0.x en versiones anteriores a 11.0.2 (liberty), cuando show_multiple_locations est\u00e1 habilitado, permiten a usuarios remotos autenticados cambiar el estado de imagen y cargar nuevos datos de imagen eliminando la \u00faltima localizaci\u00f3n de una imagen."}], "lastModified": "2023-02-12T23:16:07.577", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:image_registry_and_delivery_service_\\(glance\\):11.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90A838B8-A2EE-43CC-80BA-EC40B1DCF446"}, {"criteria": "cpe:2.3:a:openstack:image_registry_and_delivery_service_\\(glance\\):11.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB67B1D1-AFF7-4541-B5EF-739AE5913D7B"}, {"criteria": "cpe:2.3:a:openstack:image_registry_and_delivery_service_\\(glance\\):2015.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B314472-86B2-4E42-B06D-4B7F2B406147"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}