GitHub Advisoryadvisory · PyPI

GHSA-72p9-6gc7-q93r OpenStack Neutron Improper Authentication vulnerability

MEDIUM Published 2022-05-17 Modified 2023-02-08 Official page ↗
Aliases
CVE-2014-0056
Ecosystem
PyPI
Packages
neutron
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2023-02-08

Affected packages

• PyPI neutron: >= 2012.2, < 2013.2.3 → fixed in 2013.2.3

Description

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.

Related

Alias · CVE (1)

  • CVE-2014-0056 The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References