CVE-2013-4278

published 2013-09-16

CVE-2013-4278: The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which…

low 3.5 CVSS 3.1

AV N AC M Au S C P I N A N

The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for CVE-2013-2256.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	nova	< nova 2013.1.3-1 (bookworm)	nova 2013.1.3-1 (bookworm)
openstack	nova	>= 0 < 2013.1.3-1	2013.1.3-1
openstack	nova	>= 0 < 2013.1.3-1	2013.1.3-1
openstack	nova	>= 0 < 2013.1.3-1	2013.1.3-1
openstack	nova	>= 0 < 2013.1.3-1	2013.1.3-1
openstack	nova	>= 0 < 12.0.0a0	12.0.0a0

CVSS provenance

nvd 3.5 LOW AV:N/AC:M/Au:S/C:P/I:N/A:N

ghsa 6.0 MEDIUM

osv 6.0 MEDIUM