GitHub Advisoryadvisory · PyPI

GHSA-q73f-vjc2-3gqf OpenStack Image Service (Glance) allows remote authenticated users to read arbitrary file

HIGH Published 2022-05-17 Modified 2024-11-26 Official page ↗
Aliases
CVE-2015-5163
Ecosystem
PyPI
Packages
glance
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-02-08

Affected packages

• PyPI glance: >= 2015.1.0, < 2015.1.2 → fixed in 2015.1.2

Description

The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.

Related

Alias · CVE (1)

  • CVE-2015-5163 The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References