CVE-2015-5163: The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read…

PriorityP422low3.5CVSS 2.0

AVNACMAuSCPINAN

EPSS

1.50%

71.2th percentile

The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	glance	< glance 2015.1.0-4 (bookworm)	glance 2015.1.0-4 (bookworm)
glance_project	glance	>= 0 < 2015.1.0-4	2015.1.0-4
glance_project	glance	>= 0 < 2015.1.0-4	2015.1.0-4
glance_project	glance	>= 0 < 2015.1.0-4	2015.1.0-4
glance_project	glance	>= 0 < 2015.1.0-4	2015.1.0-4
glance_project	glance	>= 2015.1.0 < 2015.1.2	2015.1.2
openstack	glance	—	—
openstack	glance	—	—

CVSS provenance

nvdv2.03.5LOWAV:N/AC:M/Au:S/C:P/I:N/A:N

osv3.5LOW

vendor_debian3.5LOW

vendor_redhat3.5LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.