CVE-2014-0167

Published Apr 15, 2014

Last updated 2 years ago

Overview

Description: The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.
Source: secalert@redhat.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 6
Impact score: 6.4
Exploitability score: 6.8
Vector string: AV:N/AC:M/Au:S/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-264

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openstack:compute:2013.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6DE1DE9A-0D08-448B-AF80-7ACA236F2A83"
          },
          {
            "criteria": "cpe:2.3:a:openstack:compute:2013.1.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A1A5AAEB-0A8F-4ECF-B184-6A78B882817A"
          },
          {
            "criteria": "cpe:2.3:a:openstack:compute:2013.1.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E8596FDB-87DD-4D06-9923-75EFE7E3F9A0"
          },
          {
            "criteria": "cpe:2.3:a:openstack:compute:2013.1.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FA06A9A5-0924-4137-85AF-DB9C7C246DAC"
          },
          {
            "criteria": "cpe:2.3:a:openstack:compute:2013.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ABDB4817-2E89-48AF-AA9E-C92966A7100F"
          },
          {
            "criteria": "cpe:2.3:a:openstack:compute:2013.2.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5778F972-FB4B-49D1-8EE0-5E8B7AE74D38"
          },
          {
            "criteria": "cpe:2.3:a:openstack:compute:2013.2.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D43CFCC4-8A0A-4B8D-847E-0CD092B684E7"
          },
          {
            "criteria": "cpe:2.3:a:openstack:compute:2013.2.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "76E07164-57B7-4B0A-994E-3431FD8CF7F2"
          },
          {
            "criteria": "cpe:2.3:a:openstack:icehouse:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FC112BBD-F3D2-4192-B11A-B99D54B08D99"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References