CVE-2015-5163

published 2015-08-19

CVE-2015-5163: The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read…

low 3.5 CVSS 3.1

AV N AC M Au S C P I N A N

The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	glance	< glance 2015.1.0-4 (bookworm)	glance 2015.1.0-4 (bookworm)
glance_project	glance	>= 0 < 2015.1.0-4	2015.1.0-4
glance_project	glance	>= 0 < 2015.1.0-4	2015.1.0-4
glance_project	glance	>= 0 < 2015.1.0-4	2015.1.0-4
glance_project	glance	>= 0 < 2015.1.0-4	2015.1.0-4
glance_project	glance	>= 2015.1.0 < 2015.1.2	2015.1.2
openstack	glance	—	—
openstack	glance	—	—

CVSS provenance

nvd 3.5 LOW AV:N/AC:M/Au:S/C:P/I:N/A:N

osv 3.5 LOW

CWE-200 CWE-454