GitHub Advisoryadvisory · PyPI

GHSA-q748-mcwg-xmqv OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions

MEDIUM Published 2022-05-17 Modified 2026-01-20 Official page ↗
Aliases
CVE-2015-5251
Ecosystem
PyPI
Packages
glance
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-863
Reviewed
2023-02-08

Affected packages

• PyPI glance: >= 2011.2, < 2014.2.4 → fixed in 2014.2.4 • PyPI glance: >= 2015.1.0, < 2015.1.2 → fixed in 2015.1.2

Description

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

Related

Alias · CVE (1)

  • CVE-2015-5251 OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References