Unscored severity · published Jan 13, 2012
CVE-2012-0030
Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a…
–
CVSS
1.7%
EPSS
No
On KEV
Description
Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a modified project_id URI parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Essex · Openstack
All versions, or not specified · source: NVD
NO
Nova · Openstack
2011.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-0030
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-0030
Vendor Advisory
http://secunia.com/advisories/47543
www.securityfocus.com
http://www.securityfocus.com/bid/51370
www.ubuntu.com
http://www.ubuntu.com/usn/USN-1326-1
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/72296
github.com
https://github.com/openstack/nova/commit/3d4ffb64f1e18117240c26809788528979e3bd15#diff-0
Patch
https://lists.launchpad.net/openstack/msg06648.html
More from Essex
8.8
CVE-2013-0261
A flaw was found in PackStack
7.6
CVE-2013-0335
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC…
5.5
CVE-2013-0266
A flaw was found in the `puppetlabs-cinder` module, as used in PackStack
5.4
CVE-2012-5571
A flaw was found in OpenStack Keystone
–
CVE-2013-1838
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote authenticated users to cause a denial…