Vulnerability CVE-2016-0757
Published: 2016-04-13

Description:
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.

CVSS2 => (AV:N/AC:L/Au:S/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4/10
2.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Openstack -> Image registry and delivery service (glance) 

 References:
https://security.openstack.org/ossa/OSSA-2016-006.html
http://rhn.redhat.com/errata/RHSA-2016-0309.html
Copyright 2024, cxsecurity.com

 

Back to Top