Medium severity · published Mar 8, 2013
CVE-2013-0266
A flaw was found in the `puppetlabs-cinder` module, as used in PackStack
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the `cinder.conf` and `api-paste.ini` configuration files. A local user can exploit this by reading these files, which leads to the disclosure of OpenStack administrative passwords. This information disclosure could allow unauthorized access to sensitive OpenStack resources.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Essex · Openstack
All versions, or not specified · source: NVD
FO
Folsom · Openstack
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0266
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0266
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0595.html
access.redhat.com
https://access.redhat.com/security/cve/CVE-2013-0266
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=908581
github.com
https://github.com/puppetlabs/puppetlabs-cinder/commit/7da792fbd40c0e6eae1ee093aa00e0b177bd2ebc
More from Essex
8.8
CVE-2013-0261
A flaw was found in PackStack
7.6
CVE-2013-0335
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC…
5.4
CVE-2012-5571
A flaw was found in OpenStack Keystone
–
CVE-2013-1838
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote authenticated users to cause a denial…
–
CVE-2013-0208
The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from other users' volumes via a…