CVE-2015-5251

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

CVSS v2.0 5.5 MEDIUM

5.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:P

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2015-1897.html
https://security.openstack.org/ossa/OSSA-2015-019.html	Vendor Advisory
https://bugs.launchpad.net/bugs/1482371

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\)::::::::
	cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2015.1.1:::::::*
	cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2015.1.0:::::::*

Information

Published : 2015-10-26 10:59

Updated : 2023-02-12 16:52

NVD link : CVE-2015-5251

Mitre link : CVE-2015-5251

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Products Affected

openstack

image_registry_and_delivery_service_\(glance\)

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://rhn.redhat.com/errata/RHSA-2015-1897.html", "name": "RHSA-2015:1897", "tags": [], "refsource": "REDHAT"}, {"url": "https://security.openstack.org/ossa/OSSA-2015-019.html", "name": "https://security.openstack.org/ossa/OSSA-2015-019.html", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://bugs.launchpad.net/bugs/1482371", "name": "https://bugs.launchpad.net/bugs/1482371", "tags": [], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2015-5251", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2015-10-26T17:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:openstack:image_registry_and_delivery_service_\\(glance\\):*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2014.2.3"}, {"cpe23Uri": "cpe:2.3:a:openstack:image_registry_and_delivery_service_\\(glance\\):2015.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:openstack:image_registry_and_delivery_service_\\(glance\\):2015.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-02-13T00:52Z"}

5.5 /10