CVEvulnerability
CVE-2015-5251
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-10-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:P
- Weaknesses
- CWE-264
Description
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.
Affected configurations
• openstack image registry and delivery service \(glance\) (<= 2014.2.3)
• openstack image registry and delivery service \(glance\) 2015.1.0
• openstack image registry and delivery service \(glance\) 2015.1.1
Related
Weakness · not in database (1)
References
- http://rhn.redhat.com/errata/RHSA-2015-1897.html rhn.redhat.com
- https://bugs.launchpad.net/bugs/1482371 bugs.launchpad.net
- https://security.openstack.org/ossa/OSSA-2015-019.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1897.html rhn.redhat.com
- https://bugs.launchpad.net/bugs/1482371 bugs.launchpad.net
- https://security.openstack.org/ossa/OSSA-2015-019.html Vendor Advisory