CVE-2012-2654
Published Jun 21, 2012
Last updated 7 years ago
Overview
- Description
- The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
- Source
- secalert@redhat.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 4.3
- Impact score
- 2.9
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
- nvd@nist.gov
- CWE-20
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:compute:2012.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0E9D8029-F7DD-435D-B4F4-D3DABDB7333B"
},
{
"criteria": "cpe:2.3:a:openstack:diablo:2011.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65FA489C-5FDC-4887-9F1F-66177F87DB5E"
},
{
"criteria": "cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5FDB43F-B315-4F68-9D86-B644F2D4DF9A"
}
],
"operator": "OR"
}
]
}
]